Adobe flaws being used in attacks
CISA lists 82 flaws in Adobe products as being used in attacks, most recently on 24 Sep 2026. 11 have been used in ransomware.
AdobeBeing used in attacks
- On CISA’s list
- 82 flaws, added between 3 Nov 2021 and 24 Sep 2026
- Most recent
- CVE-2026-71362, Adobe Commerce and Magento Incorrect Authorization Vulnerability, added 24 Sep 2026
- Used in ransomware
- 11 flaws, according to CISA
- Products
- Flash Player (33), ColdFusion (16), Acrobat and Reader (13), Reader and Acrobat (8), Commerce and Magento (3), and 7 more
What to do
- Update every Adobe product you use.Install the updates Adobe offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Adobe Commerce and Magento
CVE-2026-71362Adobe Commerce and Magento Incorrect Authorization VulnerabilityAdobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Adobe Commerce and Magento
CVE-2026-75650Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityAdobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Adobe ColdFusion
CVE-2026-48282Adobe ColdFusion Path Traversal VulnerabilityAdobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Adobe Acrobat and Reader
CVE-2009-3459Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityAdobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Adobe Acrobat and Reader
CVE-2026-34621Adobe Acrobat and Reader Prototype Pollution VulnerabilityAdobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Adobe Acrobat
CVE-2020-9715Adobe Acrobat Use-After-Free VulnerabilityAdobe Acrobat contains a use-after-free vulnerability that allows for code executionCISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Adobe Commerce and Magento
CVE-2025-54236Adobe Commerce and Magento Improper Input Validation VulnerabilityAdobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Adobe Experience Manager (AEM) Forms
CVE-2025-54253Adobe Experience Manager Forms Code Execution VulnerabilityAdobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Adobe ColdFusion
CVE-2017-3066Adobe ColdFusion Deserialization VulnerabilityAdobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe ColdFusion
CVE-2024-20767Adobe ColdFusion Improper Access Control VulnerabilityAdobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe Flash Player
CVE-2014-0502Adobe Flash Player Double Free VulnerablityAdobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.CISA’s required actionThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. - Adobe Flash Player
CVE-2014-0497Adobe Flash Player Integer Underflow VulnerablityAdobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.CISA’s required actionThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. - Adobe Flash Player
CVE-2013-0648Adobe Flash Player Code Execution VulnerabilityAdobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.CISA’s required actionThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. - Adobe Flash Player
CVE-2013-0643Adobe Flash Player Incorrect Default Permissions VulnerabilityAdobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.CISA’s required actionThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. - Adobe Commerce and Magento Open Source
CVE-2024-34102Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) VulnerabilityAdobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe ColdFusion
CVE-2023-38203Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe ColdFusion
CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe Acrobat and Reader
CVE-2023-21608Adobe Acrobat and Reader Use-After-Free VulnerabilityAdobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe Acrobat and Reader
CVE-2023-26369Adobe Acrobat and Reader Out-of-Bounds Write VulnerabilityAdobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe ColdFusion
CVE-2023-26359Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe ColdFusion
CVE-2023-38205Adobe ColdFusion Improper Access Control VulnerabilityAdobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe ColdFusion
CVE-2023-29298Adobe ColdFusion Improper Access Control VulnerabilityAdobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Adobe ColdFusion
CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Adobe Acrobat and Reader
CVE-2018-4990Adobe Acrobat and Reader Double Free VulnerabilityAdobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player
CVE-2012-5054Adobe Flash Player Integer Overflow VulnerabilityAdobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2012-0767Adobe Flash Player Cross-Site Scripting (XSS) VulnerabilityAdobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2012-0754Adobe Flash Player Memory Corruption VulnerabilityAdobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Reader and Acrobat
CVE-2011-2462Adobe Reader and Acrobat Universal 3D Memory Corruption VulnerabilityThe Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player
CVE-2011-0609Adobe Flash Player Unspecified VulnerabilityAdobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Acrobat and Reader
CVE-2010-2883Adobe Acrobat and Reader Stack-Based Buffer Overflow VulnerabilityAdobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player
CVE-2010-1297Adobe Flash Player Memory Corruption VulnerabilityAdobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Acrobat and Reader
CVE-2009-4324Adobe Acrobat and Reader Use-After-Free VulnerabilityUse-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.CISA’s required actionApply updates per vendor instructions. - Adobe Acrobat and Reader
CVE-2009-3953Adobe Acrobat and Reader Universal 3D Remote Code Execution VulnerabilityAdobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.CISA’s required actionApply updates per vendor instructions. - Adobe Acrobat and Reader, Flash Player
CVE-2009-1862Adobe Acrobat and Reader, Flash Player Unspecified VulnerabilityAdobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).CISA’s required actionFor Adobe Acrobat and Reader, apply updates per vendor instructions. Read all
For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use. - Adobe Acrobat and Reader
CVE-2008-0655Adobe Acrobat and Reader Unspecified VulnerabilityAdobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.CISA’s required actionApply updates per vendor instructions. - Adobe Acrobat and Reader
CVE-2007-5659Adobe Acrobat and Reader Buffer Overflow VulnerabilityAdobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player and AIR
CVE-2016-1010Adobe Flash Player and AIR Integer Overflow VulnerabilityInteger overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.CISA’s required actionThe impacted products are end-of-life and should be disconnected if still in use. - Adobe Flash Player and AIR
CVE-2016-0984Adobe Flash Player and AIR Use-After-Free VulnerabilityUse-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.CISA’s required actionThe impacted products are end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-8651Adobe Flash Player Integer Overflow VulnerabilityInteger overflow in Adobe Flash Player allows attackers to execute code.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-0310Adobe Flash Player ASLR Bypass VulnerabilityAdobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2014-8439Adobe Flash Player Dereferenced Pointer VulnerabilityAdobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Reader and Acrobat
CVE-2014-0546Adobe Reader and Acrobat Sandbox Bypass VulnerabilityAdobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player
CVE-2018-5002Adobe Flash Player Stack-based Buffer Overflow VulnerabilityAdobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-5123Adobe Flash Player Use-After-Free VulnerabilityUse-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-5122Adobe Flash Player Use-After-Free VulnerabilityUse-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow VulnerabilityHeap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-0313Adobe Flash Player Use-After-Free VulnerabilityUse-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-0311Adobe Flash Player Remote Code Execution VulnerabilityUnspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2014-9163Adobe Flash Player Stack-Based Buffer Overflow VulnerabilityStack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Reader and Acrobat
CVE-2013-2729Adobe Reader and Acrobat Arbitrary Integer Overflow VulnerabilityInteger overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player
CVE-2012-2034Adobe Flash Player Memory Corruption VulnerabilityAdobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2016-7892Adobe Flash Player Use-After-Free VulnerabilityAdobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2016-4171Adobe Flash Player Remote Code Execution VulnerabilityUnspecified vulnerability in Adobe Flash Player allows for remote code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe ColdFusion
CVE-2010-2861Adobe ColdFusion Directory Traversal VulnerabilityA directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.CISA’s required actionApply updates per vendor instructions. - Adobe Reader and Acrobat
CVE-2009-0927Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow VulnerabilityStack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.CISA’s required actionApply updates per vendor instructions. - Adobe ColdFusion
CVE-2013-0631Adobe ColdFusion Information Disclosure VulnerabilityAdobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.CISA’s required actionApply updates per vendor instructions. - Adobe ColdFusion
CVE-2013-0629Adobe ColdFusion Directory Traversal VulnerabilityAdobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.CISA’s required actionApply updates per vendor instructions. - Adobe ColdFusion
CVE-2013-0625Adobe ColdFusion Authentication Bypass VulnerabilityAdobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.CISA’s required actionApply updates per vendor instructions. - Adobe BlazeDS
CVE-2009-3960Adobe BlazeDS Information Disclosure VulnerabilityAdobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player
CVE-2017-11292Adobe Flash Player Type Confusion VulnerabilityAdobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2016-7855Adobe Flash Player Use-After-Free VulnerabilityUse-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2016-4117Adobe Flash Player Arbitrary Code Execution VulnerabilityAn access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2016-1019Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-7645Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityA use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2015-3043Adobe Flash Player Memory Corruption VulnerabilityA memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Reader and Acrobat
CVE-2014-0496Adobe Reader and Acrobat Use-After-Free VulnerabilityAdobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.CISA’s required actionApply updates per vendor instructions. - Adobe Reader and Acrobat
CVE-2013-3346Adobe Reader and Acrobat Memory Corruption VulnerabilityAdobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.CISA’s required actionApply updates per vendor instructions. - Adobe Reader
CVE-2013-0641Adobe Reader Buffer Overflow VulnerabilityA buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.CISA’s required actionApply updates per vendor instructions. - Adobe Reader and Acrobat
CVE-2013-0640Adobe Reader and Acrobat Memory Corruption VulnerabilityAn memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.CISA’s required actionApply updates per vendor instructions. - Adobe ColdFusion
CVE-2013-0632Adobe ColdFusion Authentication Bypass VulnerabilityAn authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player
CVE-2012-1535Adobe Flash Player Arbitrary Code Execution VulnerabilityUnspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Flash Player
CVE-2011-0611Adobe Flash Player Remote Code Execution VulnerabilityAdobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Reader and Acrobat
CVE-2010-0188Adobe Reader and Acrobat Arbitrary Code Execution VulnerabilityUnspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.CISA’s required actionApply updates per vendor instructions. - Adobe Acrobat and Reader
CVE-2008-2992Adobe Reader and Acrobat Input Validation VulnerabilityAdobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.CISA’s required actionApply updates per vendor instructions. - Adobe Commerce and Magento Open Source
CVE-2022-24086Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityAdobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player
CVE-2018-15982Adobe Flash Player Use-After-Free VulnerabilityAdobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free VulnerabilityCISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Adobe Acrobat and Reader
CVE-2021-28550Adobe Acrobat and Reader Use-After-Free VulnerabilityAdobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Adobe Acrobat and Reader
CVE-2021-21017Adobe Acrobat and Reader Heap-based Buffer Overflow VulnerabilityAcrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Adobe ColdFusion
CVE-2018-15961Adobe ColdFusion Unrestricted File Upload VulnerabilityAdobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.CISA’s required actionApply updates per vendor instructions. - Adobe ColdFusion
CVE-2018-4939Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.CISA’s required actionApply updates per vendor instructions. - Adobe Flash Player
CVE-2018-4878Adobe Flash Player Use-After-Free VulnerabilityAdobe Flash Player contains a use-after-free vulnerability that could allow for code execution.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Adobe on CISA’s site.