How we count
Every figure on this page is a direct count of entries in CISA’s Known Exploited Vulnerabilities catalog attributed by CISA to Adobe (KEV field vendorProject), refreshed daily. “Ransomware-linked” counts entries CISA marks as known to be used in ransomware campaigns; the remainder are “unknown” to CISA, not confirmed ransomware-free. A KEV listing means the vulnerability has been observed exploited in the wild. Snapshot as of 2026-08-31.
Exploited Adobe vulnerabilities (CISA KEV)
| CVE | Product | Vulnerability | Added | |
|---|---|---|---|---|
| CVE-2026-48282 | ColdFusion | Adobe ColdFusion Path Traversal Vulnerability | 2026-07-07 | |
| CVE-2009-3459 | Acrobat and Reader | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | 2026-05-20 | |
| CVE-2020-9715 | Acrobat | Adobe Acrobat Use-After-Free Vulnerability | 2026-04-13 | |
| CVE-2026-34621 | Acrobat and Reader | Adobe Acrobat and Reader Prototype Pollution Vulnerability | 2026-04-13 | |
| CVE-2025-54236 | Commerce and Magento | Adobe Commerce and Magento Improper Input Validation Vulnerability | 2025-10-24 | |
| CVE-2025-54253 | Experience Manager (AEM) Forms | Adobe Experience Manager Forms Code Execution Vulnerability | 2025-10-15 | |
| CVE-2017-3066 | ColdFusion | Adobe ColdFusion Deserialization Vulnerability | 2025-02-24 | |
| CVE-2024-20767 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 2024-12-16 | |
| CVE-2014-0502 | Flash Player | Adobe Flash Player Double Free Vulnerablity | 2024-09-17 | |
| CVE-2013-0648 | Flash Player | Adobe Flash Player Code Execution Vulnerability | 2024-09-17 | |
| CVE-2013-0643 | Flash Player | Adobe Flash Player Incorrect Default Permissions Vulnerability | 2024-09-17 | |
| CVE-2014-0497 | Flash Player | Adobe Flash Player Integer Underflow Vulnerablity | 2024-09-17 | |
| CVE-2024-34102 | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | 2024-07-17 | |
| CVE-2023-29300 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2024-01-08 | ransomware |
| CVE-2023-38203 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2024-01-08 | ransomware |
| CVE-2023-21608 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 2023-10-10 | |
| CVE-2023-26369 | Acrobat and Reader | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | 2023-09-14 | |
| CVE-2023-26359 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2023-08-21 | |
| CVE-2023-29298 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 2023-07-20 | |
| CVE-2023-38205 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 2023-07-20 | |
| CVE-2023-26360 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 2023-03-15 | |
| CVE-2018-4990 | Acrobat and Reader | Adobe Acrobat and Reader Double Free Vulnerability | 2022-06-08 | |
| CVE-2012-5054 | Flash Player | Adobe Flash Player Integer Overflow Vulnerability | 2022-06-08 | |
| CVE-2012-0767 | Flash Player | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | 2022-06-08 | |
| CVE-2012-0754 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-06-08 | |
| CVE-2011-2462 | Reader and Acrobat | Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability | 2022-06-08 | |
| CVE-2011-0609 | Flash Player | Adobe Flash Player Unspecified Vulnerability | 2022-06-08 | |
| CVE-2010-2883 | Acrobat and Reader | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | 2022-06-08 | |
| CVE-2010-1297 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-06-08 | |
| CVE-2009-4324 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 2022-06-08 | |
| CVE-2009-3953 | Acrobat and Reader | Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | 2022-06-08 | |
| CVE-2009-1862 | Acrobat and Reader, Flash Player | Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability | 2022-06-08 | |
| CVE-2008-0655 | Acrobat and Reader | Adobe Acrobat and Reader Unspecified Vulnerability | 2022-06-08 | |
| CVE-2007-5659 | Acrobat and Reader | Adobe Acrobat and Reader Buffer Overflow Vulnerability | 2022-06-08 | |
| CVE-2016-1010 | Flash Player and AIR | Adobe Flash Player and AIR Integer Overflow Vulnerability | 2022-05-25 | |
| CVE-2016-0984 | Flash Player and AIR | Adobe Flash Player and AIR Use-After-Free Vulnerability | 2022-05-25 | |
| CVE-2015-0310 | Flash Player | Adobe Flash Player ASLR Bypass Vulnerability | 2022-05-25 | |
| CVE-2015-8651 | Flash Player | Adobe Flash Player Integer Overflow Vulnerability | 2022-05-25 | |
| CVE-2014-8439 | Flash Player | Adobe Flash Player Dereferenced Pointer Vulnerability | 2022-05-25 | |
| CVE-2014-0546 | Reader and Acrobat | Adobe Reader and Acrobat Sandbox Bypass Vulnerability | 2022-05-25 | |
| CVE-2018-5002 | Flash Player | Adobe Flash Player Stack-based Buffer Overflow Vulnerability | 2022-05-23 | |
| CVE-2015-5123 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-04-13 | |
| CVE-2015-5122 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-04-13 | |
| CVE-2015-3113 | Flash Player | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | 2022-04-13 | |
| CVE-2015-0313 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-04-13 | |
| CVE-2015-0311 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 2022-04-13 | |
| CVE-2014-9163 | Flash Player | Adobe Flash Player Stack-Based Buffer Overflow Vulnerability | 2022-04-13 | |
| CVE-2013-2729 | Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability | 2022-03-28 | |
| CVE-2012-2034 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 2022-03-28 | |
| CVE-2016-7892 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-03-25 | |
| CVE-2016-4171 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 2022-03-25 | |
| CVE-2010-2861 | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 2022-03-25 | ransomware |
| CVE-2009-0927 | Reader and Acrobat | Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability | 2022-03-25 | |
| CVE-2013-0631 | ColdFusion | Adobe ColdFusion Information Disclosure Vulnerability | 2022-03-07 | |
| CVE-2013-0629 | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 2022-03-07 | |
| CVE-2013-0625 | ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | 2022-03-07 | |
| CVE-2009-3960 | BlazeDS | Adobe BlazeDS Information Disclosure Vulnerability | 2022-03-07 | ransomware |
| CVE-2017-11292 | Flash Player | Adobe Flash Player Type Confusion Vulnerability | 2022-03-03 | |
| CVE-2016-7855 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 2022-03-03 | |
| CVE-2016-4117 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 2022-03-03 |
Showing the 60 most recent of 80 Adobe KEV entries. Full catalog at CISA.
← All vendors by exploited-vulnerability count
🤖 Generated by defend.network from the CISA KEV catalog. Counts are deterministic aggregates of official CISA data; verify individual advisories at the linked sources.