Vendor
Adobe: actively exploited vulnerabilities
82 vulnerabilities in Adobe products are listed in CISA’s catalog of actively exploited vulnerabilities, 11 of them used by ransomware. Latest addition on September 24, 2026: CVE-2026-71362 (Commerce and Magento ).
- 82 exploited vulnerabilities in the catalog
- 8 added in the last 12 months
- 11 used by ransomware
- 13 products affected
Affected products
- Flash Player33
- ColdFusion16
- Acrobat and Reader13
- Reader and Acrobat8
- Commerce and Magento2
- Commerce and Magento Open Source2
- Flash Player and AIR2
- Acrobat1
- Acrobat and Reader, Flash Player1
- BlazeDS1
- Commerce and Magento1
- Experience Manager (AEM) Forms1
- Reader1
All exploited vulnerabilities
CISA KEV catalog, newest first: each entry corresponds to observed exploitation.
2026 6 vulnerabilities
-
CVE-2026-71362Adobe Commerce and Magento Incorrect Authorization Vulnerability
-
CVE-2026-75650Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
-
CVE-2026-48282Adobe ColdFusion Path Traversal Vulnerability
-
CVE-2009-3459Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
-
CVE-2026-34621Adobe Acrobat and Reader Prototype Pollution Vulnerability
-
CVE-2020-9715Adobe Acrobat Use-After-Free Vulnerability
2025 3 vulnerabilities
-
CVE-2025-54236Adobe Commerce and Magento Improper Input Validation Vulnerability
-
CVE-2025-54253Adobe Experience Manager Forms Code Execution Vulnerability
-
CVE-2017-3066Adobe ColdFusion Deserialization Vulnerability
2024 8 vulnerabilities
-
CVE-2024-20767Adobe ColdFusion Improper Access Control Vulnerability
-
CVE-2014-0502Adobe Flash Player Double Free Vulnerablity
-
CVE-2014-0497Adobe Flash Player Integer Underflow Vulnerablity
-
CVE-2013-0648Adobe Flash Player Code Execution Vulnerability
-
CVE-2013-0643Adobe Flash Player Incorrect Default Permissions Vulnerability
-
CVE-2024-34102Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
-
CVE-2023-38203Used by ransomwareAdobe ColdFusion Deserialization of Untrusted Data Vulnerability
-
CVE-2023-29300Used by ransomwareAdobe ColdFusion Deserialization of Untrusted Data Vulnerability
2023 6 vulnerabilities
-
CVE-2023-21608Adobe Acrobat and Reader Use-After-Free Vulnerability
-
CVE-2023-26369Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability
-
CVE-2023-26359Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
-
CVE-2023-38205Adobe ColdFusion Improper Access Control Vulnerability
-
CVE-2023-29298Adobe ColdFusion Improper Access Control Vulnerability
-
CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
2022 54 vulnerabilities
-
CVE-2018-4990Adobe Acrobat and Reader Double Free Vulnerability
-
CVE-2012-5054Adobe Flash Player Integer Overflow Vulnerability
-
CVE-2012-0767Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
-
CVE-2012-0754Adobe Flash Player Memory Corruption Vulnerability
-
CVE-2011-2462Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
-
CVE-2011-0609Adobe Flash Player Unspecified Vulnerability
-
CVE-2010-2883Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability
-
CVE-2010-1297Adobe Flash Player Memory Corruption Vulnerability
-
CVE-2009-4324Adobe Acrobat and Reader Use-After-Free Vulnerability
-
CVE-2009-3953Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
-
CVE-2009-1862Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
-
CVE-2008-0655Adobe Acrobat and Reader Unspecified Vulnerability
-
CVE-2007-5659Adobe Acrobat and Reader Buffer Overflow Vulnerability
-
CVE-2016-1010Adobe Flash Player and AIR Integer Overflow Vulnerability
-
CVE-2016-0984Adobe Flash Player and AIR Use-After-Free Vulnerability
-
CVE-2015-8651Adobe Flash Player Integer Overflow Vulnerability
-
CVE-2015-0310Adobe Flash Player ASLR Bypass Vulnerability
-
CVE-2014-8439Adobe Flash Player Dereferenced Pointer Vulnerability
-
CVE-2014-0546Adobe Reader and Acrobat Sandbox Bypass Vulnerability
-
CVE-2018-5002Adobe Flash Player Stack-based Buffer Overflow Vulnerability
-
CVE-2015-5123Adobe Flash Player Use-After-Free Vulnerability
-
CVE-2015-5122Adobe Flash Player Use-After-Free Vulnerability
-
CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
-
CVE-2015-0313Adobe Flash Player Use-After-Free Vulnerability
-
CVE-2015-0311Adobe Flash Player Remote Code Execution Vulnerability
-
CVE-2014-9163Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
-
CVE-2013-2729Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability
-
CVE-2012-2034Adobe Flash Player Memory Corruption Vulnerability
-
CVE-2016-7892Adobe Flash Player Use-After-Free Vulnerability
-
CVE-2016-4171Adobe Flash Player Remote Code Execution Vulnerability
-
CVE-2010-2861Used by ransomwareAdobe ColdFusion Directory Traversal Vulnerability
-
CVE-2009-0927Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability
-
CVE-2013-0631Adobe ColdFusion Information Disclosure Vulnerability
-
CVE-2013-0629Adobe ColdFusion Directory Traversal Vulnerability
-
CVE-2013-0625Adobe ColdFusion Authentication Bypass Vulnerability
-
CVE-2009-3960Used by ransomwareAdobe BlazeDS Information Disclosure Vulnerability
-
CVE-2017-11292Adobe Flash Player Type Confusion Vulnerability
-
CVE-2016-7855Adobe Flash Player Use-After-Free Vulnerability
-
CVE-2016-4117Used by ransomwareAdobe Flash Player Arbitrary Code Execution Vulnerability
-
CVE-2016-1019Used by ransomwareAdobe Flash Player Arbitrary Code Execution Vulnerability
-
CVE-2015-7645Used by ransomwareAdobe Flash Player Arbitrary Code Execution Vulnerability
-
CVE-2015-5119Adobe Flash Player Use-After-Free Vulnerability
-
CVE-2015-3043Adobe Flash Player Memory Corruption Vulnerability
-
CVE-2014-0496Adobe Reader and Acrobat Use-After-Free Vulnerability
-
CVE-2013-3346Adobe Reader and Acrobat Memory Corruption Vulnerability
-
CVE-2013-0641Adobe Reader Buffer Overflow Vulnerability
-
CVE-2013-0640Adobe Reader and Acrobat Memory Corruption Vulnerability
-
CVE-2013-0632Adobe ColdFusion Authentication Bypass Vulnerability
-
CVE-2012-1535Adobe Flash Player Arbitrary Code Execution Vulnerability
-
CVE-2011-0611Adobe Flash Player Remote Code Execution Vulnerability
-
CVE-2010-0188Used by ransomwareAdobe Reader and Acrobat Arbitrary Code Execution Vulnerability
-
CVE-2008-2992Used by ransomwareAdobe Reader and Acrobat Input Validation Vulnerability
-
CVE-2022-24086Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
-
CVE-2018-15982Used by ransomwareAdobe Flash Player Use-After-Free Vulnerability
2021 5 vulnerabilities
-
CVE-2021-28550Adobe Acrobat and Reader Use-After-Free Vulnerability
-
CVE-2021-21017Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability
-
CVE-2018-4939Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
-
CVE-2018-4878Used by ransomwareAdobe Flash Player Use-After-Free Vulnerability
-
CVE-2018-15961Adobe ColdFusion Unrestricted File Upload Vulnerability
What to do
If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.
Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.