Adobe known exploited vulnerabilities
CISA lists 82 Adobe CVEs as exploited in the wild. 8 were added in the last 12 months (latest 2026-09-24), and 11 are known to be used in ransomware campaigns.
Year = when CISA added the CVE to the catalog (KEV started in November 2021).
Patch first: highest EPSS right now
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.
- CVE-2024-34102 (Commerce and Magento Open Source): EPSS 100.0%, added 2024-07-17
- CVE-2023-29300 (ColdFusion): EPSS 100.0%, added 2024-01-08
- CVE-2018-15961 (ColdFusion): EPSS 100.0%, added 2021-11-03
- CVE-2015-3113 (Flash Player): EPSS 99.9%, added 2022-04-13
- CVE-2014-0497 (Flash Player): EPSS 99.9%, added 2024-09-17
Most affected Adobe products
Flash Player (33), ColdFusion (16), Acrobat and Reader (13), Reader and Acrobat (8), Commerce and Magento Open Source (2), Flash Player and AIR (2), Commerce and Magento (1), Commerce and Magento (1), Acrobat (1), Commerce and Magento (1), Experience Manager (AEM) Forms (1), Acrobat and Reader, Flash Player (1).
All Adobe CVEs in KEV (latest 60)
| CVE | Product | Flaw | Added | Federal due | EPSS | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2026-71362 | Commerce and Magento | Commerce and Magento Incorrect Authorization | 2026-09-24 | 2026-09-27 | 87.5% | – |
| CVE-2026-75650 | Commerce and Magento | Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine | 2026-09-08 | 2026-09-11 | 3.9% | – |
| CVE-2026-48282 | ColdFusion | ColdFusion Path Traversal | 2026-07-07 | 2026-07-10 | 42.4% | – |
| CVE-2009-3459 | Acrobat and Reader | Acrobat and Reader Heap-Based Buffer Overflow | 2026-05-20 | 2026-06-03 | 86.6% | – |
| CVE-2026-34621 | Acrobat and Reader | Acrobat and Reader Prototype Pollution | 2026-04-13 | 2026-04-27 | 2.2% | – |
| CVE-2020-9715 | Acrobat | Acrobat Use-After-Free | 2026-04-13 | 2026-04-27 | 48.6% | – |
| CVE-2025-54236 | Commerce and Magento | Commerce and Magento Improper Input Validation | 2025-10-24 | 2025-11-14 | 94.5% | – |
| CVE-2025-54253 | Experience Manager (AEM) Forms | Experience Manager Forms Code Execution | 2025-10-15 | 2025-11-05 | 88.0% | – |
| CVE-2017-3066 | ColdFusion | ColdFusion Deserialization | 2025-02-24 | 2025-03-17 | 90.6% | – |
| CVE-2024-20767 | ColdFusion | ColdFusion Improper Access Control | 2024-12-16 | 2025-01-06 | 98.5% | – |
| CVE-2014-0502 | Flash Player | Flash Player Double Free Vulnerablity | 2024-09-17 | 2024-10-08 | 24.8% | – |
| CVE-2014-0497 | Flash Player | Flash Player Integer Underflow Vulnerablity | 2024-09-17 | 2024-10-08 | 99.9% | – |
| CVE-2013-0648 | Flash Player | Flash Player Code Execution | 2024-09-17 | 2024-10-08 | 11.1% | – |
| CVE-2013-0643 | Flash Player | Flash Player Incorrect Default Permissions | 2024-09-17 | 2024-10-08 | 10.5% | – |
| CVE-2024-34102 | Commerce and Magento Open Source | Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) | 2024-07-17 | 2024-08-07 | 100.0% | – |
| CVE-2023-38203 | ColdFusion | ColdFusion Deserialization of Untrusted Data | 2024-01-08 | 2024-01-29 | 97.1% | Yes |
| CVE-2023-29300 | ColdFusion | ColdFusion Deserialization of Untrusted Data | 2024-01-08 | 2024-01-29 | 100.0% | Yes |
| CVE-2023-21608 | Acrobat and Reader | Acrobat and Reader Use-After-Free | 2023-10-10 | 2023-10-31 | 61.5% | – |
| CVE-2023-26369 | Acrobat and Reader | Acrobat and Reader Out-of-Bounds Write | 2023-09-14 | 2023-10-05 | 6.7% | – |
| CVE-2023-26359 | ColdFusion | ColdFusion Deserialization of Untrusted Data | 2023-08-21 | 2023-09-11 | 17.0% | – |
| CVE-2023-38205 | ColdFusion | ColdFusion Improper Access Control | 2023-07-20 | 2023-08-10 | 99.7% | – |
| CVE-2023-29298 | ColdFusion | ColdFusion Improper Access Control | 2023-07-20 | 2023-08-10 | 99.8% | – |
| CVE-2023-26360 | ColdFusion | ColdFusion Deserialization of Untrusted Data | 2023-03-15 | 2023-04-05 | 97.3% | – |
| CVE-2018-4990 | Acrobat and Reader | Acrobat and Reader Double Free | 2022-06-08 | 2022-06-22 | 36.2% | – |
| CVE-2012-5054 | Flash Player | Flash Player Integer Overflow | 2022-06-08 | 2022-06-22 | 21.2% | – |
| CVE-2012-0767 | Flash Player | Flash Player Cross-Site Scripting (XSS) | 2022-06-08 | 2022-06-22 | 6.4% | – |
| CVE-2012-0754 | Flash Player | Flash Player Memory Corruption | 2022-06-08 | 2022-06-22 | 91.2% | – |
| CVE-2011-2462 | Reader and Acrobat | Reader and Acrobat Universal 3D Memory Corruption | 2022-06-08 | 2022-06-22 | 88.5% | – |
| CVE-2011-0609 | Flash Player | Flash Player Unspecified | 2022-06-08 | 2022-06-22 | 63.5% | – |
| CVE-2010-2883 | Acrobat and Reader | Acrobat and Reader Stack-Based Buffer Overflow | 2022-06-08 | 2022-06-22 | 81.4% | – |
| CVE-2010-1297 | Flash Player | Flash Player Memory Corruption | 2022-06-08 | 2022-06-22 | 82.2% | – |
| CVE-2009-4324 | Acrobat and Reader | Acrobat and Reader Use-After-Free | 2022-06-08 | 2022-06-22 | 81.9% | – |
| CVE-2009-3953 | Acrobat and Reader | Acrobat and Reader Universal 3D Remote Code Execution | 2022-06-08 | 2022-06-22 | 83.2% | – |
| CVE-2009-1862 | Acrobat and Reader, Flash Player | Acrobat and Reader, Flash Player Unspecified | 2022-06-08 | 2022-06-22 | 21.2% | – |
| CVE-2008-0655 | Acrobat and Reader | Acrobat and Reader Unspecified | 2022-06-08 | 2022-06-22 | 37.9% | – |
| CVE-2007-5659 | Acrobat and Reader | Acrobat and Reader Buffer Overflow | 2022-06-08 | 2022-06-22 | 87.4% | – |
| CVE-2016-1010 | Flash Player and AIR | Flash Player and AIR Integer Overflow | 2022-05-25 | 2022-06-15 | 19.3% | – |
| CVE-2016-0984 | Flash Player and AIR | Flash Player and AIR Use-After-Free | 2022-05-25 | 2022-06-15 | 54.5% | – |
| CVE-2015-8651 | Flash Player | Flash Player Integer Overflow | 2022-05-25 | 2022-06-15 | 67.7% | – |
| CVE-2015-0310 | Flash Player | Flash Player ASLR Bypass | 2022-05-25 | 2022-06-15 | 15.1% | – |
| CVE-2014-8439 | Flash Player | Flash Player Dereferenced Pointer | 2022-05-25 | 2022-06-15 | 20.4% | – |
| CVE-2014-0546 | Reader and Acrobat | Reader and Acrobat Sandbox Bypass | 2022-05-25 | 2022-06-15 | 22.3% | – |
| CVE-2018-5002 | Flash Player | Flash Player Stack-based Buffer Overflow | 2022-05-23 | 2022-06-13 | 25.1% | – |
| CVE-2015-5123 | Flash Player | Flash Player Use-After-Free | 2022-04-13 | 2022-05-04 | 18.8% | – |
| CVE-2015-5122 | Flash Player | Flash Player Use-After-Free | 2022-04-13 | 2022-05-04 | 94.0% | – |
| CVE-2015-3113 | Flash Player | Flash Player Heap-Based Buffer Overflow | 2022-04-13 | 2022-05-04 | 99.9% | – |
| CVE-2015-0313 | Flash Player | Flash Player Use-After-Free | 2022-04-13 | 2022-05-04 | 95.3% | – |
| CVE-2015-0311 | Flash Player | Flash Player Remote Code Execution | 2022-04-13 | 2022-05-04 | 85.6% | – |
| CVE-2014-9163 | Flash Player | Flash Player Stack-Based Buffer Overflow | 2022-04-13 | 2022-05-04 | 20.7% | – |
| CVE-2013-2729 | Reader and Acrobat | Reader and Acrobat Arbitrary Integer Overflow | 2022-03-28 | 2022-04-18 | 66.6% | – |
| CVE-2012-2034 | Flash Player | Flash Player Memory Corruption | 2022-03-28 | 2022-04-18 | 7.8% | – |
| CVE-2016-7892 | Flash Player | Flash Player Use-After-Free | 2022-03-25 | 2022-04-15 | 18.8% | – |
| CVE-2016-4171 | Flash Player | Flash Player Remote Code Execution | 2022-03-25 | 2022-04-15 | 20.1% | – |
| CVE-2010-2861 | ColdFusion | ColdFusion Directory Traversal | 2022-03-25 | 2022-04-15 | 99.7% | Yes |
| CVE-2009-0927 | Reader and Acrobat | Reader and Acrobat Stack-Based Buffer Overflow | 2022-03-25 | 2022-04-15 | 96.6% | – |
| CVE-2013-0631 | ColdFusion | ColdFusion Information Disclosure | 2022-03-07 | 2022-09-07 | 66.4% | – |
| CVE-2013-0629 | ColdFusion | ColdFusion Directory Traversal | 2022-03-07 | 2022-09-07 | 65.8% | – |
| CVE-2013-0625 | ColdFusion | ColdFusion Authentication Bypass | 2022-03-07 | 2022-09-07 | 93.8% | – |
| CVE-2009-3960 | BlazeDS | BlazeDS Information Disclosure | 2022-03-07 | 2022-09-07 | 90.1% | Yes |
| CVE-2017-11292 | Flash Player | Flash Player Type Confusion | 2022-03-03 | 2022-03-24 | 11.9% | – |
Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.
Read next: Which CVEs to patch first this week · All vendors