All vendors
Adobe KEV entries added per year — 2021: 5, 2022: 54, 2023: 6, 2024: 8, 2025: 3, 2026: 6.
Adobe — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Adobe with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
82 KEV entries
11 ransomware-linked
14 products
avg CVSS 8.7
last added 2026-09-24
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 82 Adobe vulnerabilities confirmed as exploited in the wild across 14 products; 11 of them (13%) are flagged as used in known ransomware campaigns. Flash Player is the most-affected product, with 33 entries (40% of the total). CISA added 6 entries in 2026 so far, compared with 3 in 2025. Across the 82 entries with an NVD CVSS score (100% of the total), the average score is 8.7; 31 entries are rated critical by NVD. The most recent addition is CVE-2026-71362 (Adobe Commerce and Magento Incorrect Authorization Vulnerability ), added on 2026-09-24.
Affected products
| Product | Entries | Share |
|---|---|---|
| Flash Player | 33 | 40% |
| ColdFusion | 16 | 20% |
| Acrobat and Reader | 13 | 16% |
| Reader and Acrobat | 8 | 9.8% |
| Commerce and Magento Open Source | 2 | 2.4% |
| Flash Player and AIR | 2 | 2.4% |
| Commerce and Magento | 1 | 1.2% |
| Commerce and Magento | 1 | 1.2% |
| Acrobat | 1 | 1.2% |
| Commerce and Magento | 1 | 1.2% |
| Experience Manager (AEM) Forms | 1 | 1.2% |
| Acrobat and Reader, Flash Player | 1 | 1.2% |
| BlazeDS | 1 | 1.2% |
| Reader | 1 | 1.2% |
Entries added per year
By date added to the KEV catalog
Exploited Adobe vulnerabilities (82)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2026-71362 | Commerce and Magento | Adobe Commerce and Magento Incorrect Authorization Vulnerability | 2026-09-24 | — | CRITICAL9.1 |
| CVE-2026-75650 | Commerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 2026-09-08 | — | CRITICAL10.0 |
| CVE-2026-48282 | ColdFusion | Adobe ColdFusion Path Traversal Vulnerability | 2026-07-07 | — | CRITICAL10.0 |
| CVE-2009-3459 | Acrobat and Reader | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | 2026-05-20 | — | HIGH8.8 |
| CVE-2020-9715 | Acrobat | Adobe Acrobat Use-After-Free Vulnerability | 2026-04-13 | — | HIGH7.8 |
| CVE-2026-34621 | Acrobat and Reader | Adobe Acrobat and Reader Prototype Pollution Vulnerability | 2026-04-13 | — | HIGH8.6 |
| CVE-2025-54236 | Commerce and Magento | Adobe Commerce and Magento Improper Input Validation Vulnerability | 2025-10-24 | — | CRITICAL9.1 |
| CVE-2025-54253 | Experience Manager (AEM) Forms | Adobe Experience Manager Forms Code Execution Vulnerability | 2025-10-15 | — | CRITICAL10.0 |
| CVE-2017-3066 | ColdFusion | Adobe ColdFusion Deserialization Vulnerability | 2025-02-24 | — | CRITICAL9.8 |
| CVE-2024-20767 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 2024-12-16 | — | HIGH7.4 |
| CVE-2014-0502 | Flash Player | Adobe Flash Player Double Free Vulnerablity | 2024-09-17 | — | HIGH8.8 |
| CVE-2013-0648 | Flash Player | Adobe Flash Player Code Execution Vulnerability | 2024-09-17 | — | HIGH8.8 |
| CVE-2013-0643 | Flash Player | Adobe Flash Player Incorrect Default Permissions Vulnerability | 2024-09-17 | — | HIGH8.8 |
| CVE-2014-0497 | Flash Player | Adobe Flash Player Integer Underflow Vulnerablity | 2024-09-17 | — | CRITICAL9.8 |
| CVE-2024-34102 | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | 2024-07-17 | — | CRITICAL9.8 |
| CVE-2023-29300 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2024-01-08 | Known | CRITICAL9.8 |
| CVE-2023-38203 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2024-01-08 | Known | CRITICAL9.8 |
| CVE-2023-21608 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 2023-10-10 | — | HIGH7.8 |
| CVE-2023-26369 | Acrobat and Reader | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | 2023-09-14 | — | HIGH7.8 |
| CVE-2023-26359 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2023-08-21 | — | CRITICAL9.8 |
| CVE-2023-29298 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 2023-07-20 | — | HIGH7.5 |
| CVE-2023-38205 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 2023-07-20 | — | HIGH7.5 |
| CVE-2023-26360 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2023-03-15 | — | HIGH8.6 |
| CVE-2018-4990 | Acrobat and Reader | Adobe Acrobat and Reader Double Free Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2012-5054 | Flash Player | Adobe Flash Player Integer Overflow Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2012-0767 | Flash Player | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | 2022-06-08 | — | MEDIUM6.1 |
| CVE-2012-0754 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-06-08 | — | HIGH8.1 |
| CVE-2011-2462 | Reader and Acrobat | Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability | 2022-06-08 | — | CRITICAL9.8 |
| CVE-2011-0609 | Flash Player | Adobe Flash Player Unspecified Vulnerability | 2022-06-08 | — | HIGH7.8 |
| CVE-2010-2883 | Acrobat and Reader | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | 2022-06-08 | — | HIGH7.3 |
| CVE-2010-1297 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-06-08 | — | HIGH7.8 |
| CVE-2009-4324 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 2022-06-08 | — | HIGH7.8 |
| CVE-2009-3953 | Acrobat and Reader | Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2009-1862 | Acrobat and Reader, Flash Player | Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability | 2022-06-08 | — | HIGH7.8 |
| CVE-2008-0655 | Acrobat and Reader | Adobe Acrobat and Reader Unspecified Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2007-5659 | Acrobat and Reader | Adobe Acrobat and Reader Buffer Overflow Vulnerability | 2022-06-08 | — | HIGH7.8 |
| CVE-2016-1010 | Flash Player and AIR | Adobe Flash Player and AIR Integer Overflow Vulnerability | 2022-05-25 | — | HIGH8.8 |
| CVE-2016-0984 | Flash Player and AIR | Adobe Flash Player and AIR Use-After-Free Vulnerability | 2022-05-25 | — | HIGH8.8 |
| CVE-2015-0310 | Flash Player | Adobe Flash Player ASLR Bypass Vulnerability | 2022-05-25 | — | HIGH7.8 |
| CVE-2015-8651 | Flash Player | Adobe Flash Player Integer Overflow Vulnerability | 2022-05-25 | — | HIGH8.8 |
| CVE-2014-8439 | Flash Player | Adobe Flash Player Dereferenced Pointer Vulnerability | 2022-05-25 | — | HIGH8.8 |
| CVE-2014-0546 | Reader and Acrobat | Adobe Reader and Acrobat Sandbox Bypass Vulnerability | 2022-05-25 | — | CRITICAL9.8 |
| CVE-2018-5002 | Flash Player | Adobe Flash Player Stack-based Buffer Overflow Vulnerability | 2022-05-23 | — | HIGH7.8 |
| CVE-2015-5123 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-04-13 | — | CRITICAL9.8 |
| CVE-2015-5122 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-04-13 | — | CRITICAL9.8 |
| CVE-2015-3113 | Flash Player | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | 2022-04-13 | — | CRITICAL9.8 |
| CVE-2015-0313 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-04-13 | — | CRITICAL9.8 |
| CVE-2015-0311 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 2022-04-13 | — | CRITICAL9.8 |
| CVE-2014-9163 | Flash Player | Adobe Flash Player Stack-Based Buffer Overflow Vulnerability | 2022-04-13 | — | HIGH7.8 |
| CVE-2013-2729 | Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability | 2022-03-28 | — | CRITICAL9.8 |
| CVE-2012-2034 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-03-28 | — | HIGH7.5 |
| CVE-2016-7892 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-03-25 | — | HIGH8.8 |
| CVE-2016-4171 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 2022-03-25 | — | CRITICAL9.8 |
| CVE-2010-2861 | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 2022-03-25 | Known | CRITICAL9.8 |
| CVE-2009-0927 | Reader and Acrobat | Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability | 2022-03-25 | — | HIGH8.8 |
| CVE-2013-0631 | ColdFusion | Adobe ColdFusion Information Disclosure Vulnerability | 2022-03-07 | — | HIGH7.5 |
| CVE-2013-0629 | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 2022-03-07 | — | HIGH7.5 |
| CVE-2013-0625 | ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | 2022-03-07 | — | CRITICAL9.8 |
| CVE-2009-3960 | BlazeDS | Adobe BlazeDS Information Disclosure Vulnerability | 2022-03-07 | Known | MEDIUM6.5 |
| CVE-2017-11292 | Flash Player | Adobe Flash Player Type Confusion Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2016-7855 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2016-4117 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 2022-03-03 | Known | CRITICAL9.8 |
| CVE-2016-1019 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 2022-03-03 | Known | CRITICAL9.8 |
| CVE-2015-7645 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 2022-03-03 | Known | HIGH7.8 |
| CVE-2015-5119 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-03-03 | — | CRITICAL9.8 |
| CVE-2015-3043 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-03-03 | — | CRITICAL9.8 |
| CVE-2014-0496 | Reader and Acrobat | Adobe Reader and Acrobat Use-After-Free Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2013-3346 | Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | 2022-03-03 | — | CRITICAL9.8 |
| CVE-2013-0641 | Reader | Adobe Reader Buffer Overflow Vulnerability | 2022-03-03 | — | HIGH7.8 |
| CVE-2013-0640 | Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | 2022-03-03 | — | HIGH7.8 |
| CVE-2013-0632 | ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | 2022-03-03 | — | CRITICAL9.8 |
| CVE-2012-1535 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 2022-03-03 | — | HIGH7.8 |
| CVE-2011-0611 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 2022-03-03 | — | HIGH8.8 |
| CVE-2010-0188 | Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability | 2022-03-03 | Known | HIGH7.8 |
| CVE-2008-2992 | Acrobat and Reader | Adobe Reader and Acrobat Input Validation Vulnerability | 2022-03-03 | Known | HIGH7.8 |
| CVE-2022-24086 | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | 2022-02-15 | — | CRITICAL9.8 |
| CVE-2018-15982 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-02-15 | Known | HIGH7.8 |
| CVE-2021-21017 | Acrobat and Reader | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-28550 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2018-4939 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2018-15961 | ColdFusion | Adobe ColdFusion Unrestricted File Upload Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2018-4878 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2021-11-03 | Known | HIGH7.8 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.