Known exploited vulnerabilities

Adobe vulnerabilities attackers have used

Every Adobe vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 83 Adobe vulnerabilities as exploited in the wild, 7 of them added in the last 12 months and 11 used in ransomware campaigns. The most recent is CVE-2026-48356, added Oct 27, 2026. Flash Player has the most entries (33).

In KEV, all time
83
Added, last 12 months
7
Used in ransomware
11
New CVEs this week
7

By product

Flash Player (33), ColdFusion (16), Acrobat and Reader (13), Reader and Acrobat (8), Commerce and Magento (3), Commerce and Magento Open Source (2), Flash Player and AIR (2), Acrobat (1), Acrobat and Reader, Flash Player (1), BlazeDS (1), Commerce and Magento (1), Experience Manager (AEM) Forms (1), and 1 more.

New Critical and High Adobe CVEs this week

  • CVE-2026-122102highAdobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially…
  • CVE-2026-121904criticalAdobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially…
  • CVE-2026-121890highAdobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue…
  • CVE-2026-121355criticalAdobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.
  • CVE-2026-121350highAdobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. A low-privileged attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not…
  • CVE-2026-113557highAudition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file…
  • CVE-2026-110091highPremiere Pro is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is…

Every Adobe entry in CISA KEV

  1. CVE-2026-48356

    Added · due

    Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

    Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the…

  2. CVE-2026-71362

    Added · due

    Adobe Commerce and Magento Incorrect Authorization Vulnerability

    Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.

  3. CVE-2026-75650

    Added · due

    Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

    Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

  4. CVE-2026-48282

    Added · due

    Adobe ColdFusion Path Traversal Vulnerability

    Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.

  5. CVE-2009-3459

    Added · due

    Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

    Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.

  6. CVE-2026-34621

    Added · due

    Adobe Acrobat and Reader Prototype Pollution Vulnerability

    Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.

  7. CVE-2020-9715

    Added · due

    Adobe Acrobat Use-After-Free Vulnerability

    Adobe Acrobat contains a use-after-free vulnerability that allows for code execution

  8. CVE-2025-54236

    Added · due

    Adobe Commerce and Magento Improper Input Validation Vulnerability

    Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.

  9. CVE-2025-54253

    Added · due

    Adobe Experience Manager Forms Code Execution Vulnerability

    Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.

  10. CVE-2017-3066

    Added · due

    Adobe ColdFusion Deserialization Vulnerability

    Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.

  11. CVE-2024-20767

    Added · due

    Adobe ColdFusion Improper Access Control Vulnerability

    Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.

  12. CVE-2014-0502

    Added · due

    Adobe Flash Player Double Free Vulnerablity

    Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.

  13. CVE-2014-0497

    Added · due

    Adobe Flash Player Integer Underflow Vulnerablity

    Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.

  14. CVE-2013-0648

    Added · due

    Adobe Flash Player Code Execution Vulnerability

    Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.

  15. CVE-2013-0643

    Added · due

    Adobe Flash Player Incorrect Default Permissions Vulnerability

    Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.

  16. CVE-2024-34102

    Added · due

    Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

    Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.

  17. CVE-2023-38203

    RansomwareAdded · due

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.

  18. CVE-2023-29300

    RansomwareAdded · due

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.

  19. CVE-2023-21608

    Added · due

    Adobe Acrobat and Reader Use-After-Free Vulnerability

    Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.

  20. CVE-2023-26369

    Added · due

    Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

    Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.

  21. CVE-2023-26359

    Added · due

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.

  22. CVE-2023-38205

    Added · due

    Adobe ColdFusion Improper Access Control Vulnerability

    Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.

  23. CVE-2023-29298

    Added · due

    Adobe ColdFusion Improper Access Control Vulnerability

    Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.

  24. CVE-2023-26360

    Added · due

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.

  25. CVE-2018-4990

    Added · due

    Adobe Acrobat and Reader Double Free Vulnerability

    Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.

  26. CVE-2012-5054

    Added · due

    Adobe Flash Player Integer Overflow Vulnerability

    Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.

  27. CVE-2012-0767

    Added · due

    Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability

    Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.

  28. CVE-2012-0754

    Added · due

    Adobe Flash Player Memory Corruption Vulnerability

    Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

  29. CVE-2011-2462

    Added · due

    Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability

    The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).

  30. CVE-2011-0609

    Added · due

    Adobe Flash Player Unspecified Vulnerability

    Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

  31. CVE-2010-2883

    Added · due

    Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability

    Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

  32. CVE-2010-1297

    Added · due

    Adobe Flash Player Memory Corruption Vulnerability

    Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

  33. CVE-2009-4324

    Added · due

    Adobe Acrobat and Reader Use-After-Free Vulnerability

    Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.

  34. CVE-2009-3953

    Added · due

    Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

    Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.

  35. CVE-2009-1862

    Added · due

    Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability

    Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).

  36. CVE-2008-0655

    Added · due

    Adobe Acrobat and Reader Unspecified Vulnerability

    Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.

  37. CVE-2007-5659

    Added · due

    Adobe Acrobat and Reader Buffer Overflow Vulnerability

    Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.

  38. CVE-2016-1010

    Added · due

    Adobe Flash Player and AIR Integer Overflow Vulnerability

    Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.

  39. CVE-2016-0984

    Added · due

    Adobe Flash Player and AIR Use-After-Free Vulnerability

    Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.

  40. CVE-2015-8651

    Added · due

    Adobe Flash Player Integer Overflow Vulnerability

    Integer overflow in Adobe Flash Player allows attackers to execute code.

  41. CVE-2015-0310

    Added · due

    Adobe Flash Player ASLR Bypass Vulnerability

    Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.

  42. CVE-2014-8439

    Added · due

    Adobe Flash Player Dereferenced Pointer Vulnerability

    Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.

  43. CVE-2014-0546

    Added · due

    Adobe Reader and Acrobat Sandbox Bypass Vulnerability

    Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.

  44. CVE-2018-5002

    Added · due

    Adobe Flash Player Stack-based Buffer Overflow Vulnerability

    Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.

  45. CVE-2015-5123

    Added · due

    Adobe Flash Player Use-After-Free Vulnerability

    Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).

  46. CVE-2015-5122

    Added · due

    Adobe Flash Player Use-After-Free Vulnerability

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).

  47. CVE-2015-3113

    Added · due

    Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

    Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.

  48. CVE-2015-0313

    Added · due

    Adobe Flash Player Use-After-Free Vulnerability

    Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.

  49. CVE-2015-0311

    Added · due

    Adobe Flash Player Remote Code Execution Vulnerability

    Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.

  50. CVE-2014-9163

    Added · due

    Adobe Flash Player Stack-Based Buffer Overflow Vulnerability

    Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.

  51. CVE-2013-2729

    Added · due

    Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability

    Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.

  52. CVE-2012-2034

    Added · due

    Adobe Flash Player Memory Corruption Vulnerability

    Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).

  53. CVE-2016-7892

    Added · due

    Adobe Flash Player Use-After-Free Vulnerability

    Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.

  54. CVE-2016-4171

    Added · due

    Adobe Flash Player Remote Code Execution Vulnerability

    Unspecified vulnerability in Adobe Flash Player allows for remote code execution.

  55. CVE-2010-2861

    RansomwareAdded · due

    Adobe ColdFusion Directory Traversal Vulnerability

    A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.

  56. CVE-2009-0927

    Added · due

    Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability

    Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.

  57. CVE-2013-0631

    Added · due

    Adobe ColdFusion Information Disclosure Vulnerability

    Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.

  58. CVE-2013-0629

    Added · due

    Adobe ColdFusion Directory Traversal Vulnerability

    Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.

  59. CVE-2013-0625

    Added · due

    Adobe ColdFusion Authentication Bypass Vulnerability

    Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.

  60. CVE-2009-3960

    RansomwareAdded · due

    Adobe BlazeDS Information Disclosure Vulnerability

    Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.

  61. CVE-2017-11292

    Added · due

    Adobe Flash Player Type Confusion Vulnerability

    Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.

  62. CVE-2016-7855

    Added · due

    Adobe Flash Player Use-After-Free Vulnerability

    Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.

  63. CVE-2016-4117

    RansomwareAdded · due

    Adobe Flash Player Arbitrary Code Execution Vulnerability

    An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.

  64. CVE-2016-1019

    RansomwareAdded · due

    Adobe Flash Player Arbitrary Code Execution Vulnerability

    Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.

  65. CVE-2015-7645

    RansomwareAdded · due

    Adobe Flash Player Arbitrary Code Execution Vulnerability

    Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.

  66. CVE-2015-5119

    Added · due

    Adobe Flash Player Use-After-Free Vulnerability

    A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.

  67. CVE-2015-3043

    Added · due

    Adobe Flash Player Memory Corruption Vulnerability

    A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.

  68. CVE-2014-0496

    Added · due

    Adobe Reader and Acrobat Use-After-Free Vulnerability

    Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.

  69. CVE-2013-3346

    Added · due

    Adobe Reader and Acrobat Memory Corruption Vulnerability

    Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.

  70. CVE-2013-0641

    Added · due

    Adobe Reader Buffer Overflow Vulnerability

    A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.

  71. CVE-2013-0640

    Added · due

    Adobe Reader and Acrobat Memory Corruption Vulnerability

    An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.

  72. CVE-2013-0632

    Added · due

    Adobe ColdFusion Authentication Bypass Vulnerability

    An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.

  73. CVE-2012-1535

    Added · due

    Adobe Flash Player Arbitrary Code Execution Vulnerability

    Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.

  74. CVE-2011-0611

    Added · due

    Adobe Flash Player Remote Code Execution Vulnerability

    Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.

  75. CVE-2010-0188

    RansomwareAdded · due

    Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability

    Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.

  76. CVE-2008-2992

    RansomwareAdded · due

    Adobe Reader and Acrobat Input Validation Vulnerability

    Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.

  77. CVE-2022-24086

    Added · due

    Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

    Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

  78. CVE-2018-15982

    RansomwareAdded · due

    Adobe Flash Player Use-After-Free Vulnerability

    Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability

  79. CVE-2021-28550

    Added · due

    Adobe Acrobat and Reader Use-After-Free Vulnerability

    Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

  80. CVE-2021-21017

    Added · due

    Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

    Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

  81. CVE-2018-4939

    Added · due

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.

  82. CVE-2018-4878

    RansomwareAdded · due

    Adobe Flash Player Use-After-Free Vulnerability

    Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.

  83. CVE-2018-15961

    Added · due

    Adobe ColdFusion Unrestricted File Upload Vulnerability

    Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.