Adobe: every exploited CVE on CISA KEV
All 83 Adobe bugs attackers are confirmed to be using, with attack scores and free detection rules.
Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
83
Adobe bugs on CISA’s exploited list
7 added in 2026.
11
are linked to ransomware
Every Adobe vulnerability the US government has confirmed attackers are using, newest first, with each bug’s EPSS (predicted attack chance) and VEDAS (exploit evidence) scores and any free Nuclei or Suricata detection rule. US federal agencies must fix KEV-listed bugs by a deadline; everyone else should treat the list as “patch first”.
| Added | CVE | Product | Bug | EPSS | VEDAS | Detection rule | Ransomware |
|---|---|---|---|---|---|---|---|
| 2026-10-27 | CVE-2026-48356 | Adobe Commerce and Magento | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | 0.45 | 0.98 | None yet | No |
| 2026-09-24 | CVE-2026-71362 | Adobe Commerce and Magento | Adobe Commerce and Magento Incorrect Authorization Vulnerability | 0.90 | 0.98 | Nuclei · Suricata | No |
| 2026-09-08 | CVE-2026-75650 | Adobe Commerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 0.04 | 0.97 | None yet | No |
| 2026-07-07 | CVE-2026-48282 | Adobe ColdFusion | Adobe ColdFusion Path Traversal Vulnerability | 0.42 | 0.98 | Nuclei · Suricata | No |
| 2026-05-20 | CVE-2009-3459 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | 0.87 | 0.98 | None yet | No |
| 2026-04-13 | CVE-2026-34621 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Prototype Pollution Vulnerability | 0.07 | 0.76 | Out of scope (local) | No |
| 2026-04-13 | CVE-2020-9715 | Adobe Acrobat | Adobe Acrobat Use-After-Free Vulnerability | 0.33 | 0.99 | Out of scope (local) | No |
| 2025-10-24 | CVE-2025-54236 | Adobe Commerce and Magento | Adobe Commerce and Magento Improper Input Validation Vulnerability | 0.95 | 0.99 | Nuclei · Suricata | No |
| 2025-10-15 | CVE-2025-54253 | Adobe Experience Manager (AEM) Forms | Adobe Experience Manager Forms Code Execution Vulnerability | 0.89 | 0.99 | Nuclei · Suricata | No |
| 2025-02-24 | CVE-2017-3066 | Adobe ColdFusion | Adobe ColdFusion Deserialization Vulnerability | 0.91 | 0.98 | Suricata | No |
| 2024-12-16 | CVE-2024-20767 | Adobe ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 0.99 | 0.99 | Nuclei · Suricata | No |
| 2024-09-17 | CVE-2014-0502 | Adobe Flash Player | Adobe Flash Player Double Free Vulnerablity | 0.25 | 0.98 | None yet | No |
| 2024-09-17 | CVE-2014-0497 | Adobe Flash Player | Adobe Flash Player Integer Underflow Vulnerablity | 1.00 | 0.98 | None yet | No |
| 2024-09-17 | CVE-2013-0648 | Adobe Flash Player | Adobe Flash Player Code Execution Vulnerability | 0.11 | 0.54 | None yet | No |
| 2024-09-17 | CVE-2013-0643 | Adobe Flash Player | Adobe Flash Player Incorrect Default Permissions Vulnerability | 0.11 | 0.54 | None yet | No |
| 2024-07-17 | CVE-2024-34102 | Adobe Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | No |
| 2024-01-08 | CVE-2023-38203 | Adobe ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 0.97 | 0.99 | Nuclei · Suricata | Yes |
| 2024-01-08 | CVE-2023-29300 | Adobe ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | Yes |
| 2023-10-10 | CVE-2023-21608 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 0.59 | 0.99 | Out of scope (local) | No |
| 2023-09-14 | CVE-2023-26369 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | 0.07 | 0.97 | Out of scope (local) | No |
| 2023-08-21 | CVE-2023-26359 | Adobe ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 0.17 | 0.98 | None yet | No |
| 2023-07-20 | CVE-2023-38205 | Adobe ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | No |
| 2023-07-20 | CVE-2023-29298 | Adobe ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | No |
| 2023-03-15 | CVE-2023-26360 | Adobe ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 0.97 | 0.99 | Nuclei · Suricata | No |
| 2022-06-08 | CVE-2018-4990 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Double Free Vulnerability | 0.36 | 0.98 | None yet | No |
| 2022-06-08 | CVE-2012-5054 | Adobe Flash Player | Adobe Flash Player Integer Overflow Vulnerability | 0.21 | 0.85 | None yet | No |
| 2022-06-08 | CVE-2012-0767 | Adobe Flash Player | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | 0.06 | 0.52 | None yet | No |
| 2022-06-08 | CVE-2012-0754 | Adobe Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 0.91 | 0.99 | Out of scope (local) | No |
| 2022-06-08 | CVE-2011-2462 | Adobe Reader and Acrobat | Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability | 0.89 | 0.98 | None yet | No |
| 2022-06-08 | CVE-2011-0609 | Adobe Flash Player | Adobe Flash Player Unspecified Vulnerability | 0.64 | 0.98 | Out of scope (local) | No |
| 2022-06-08 | CVE-2010-2883 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | 0.81 | 0.99 | Out of scope (local) | No |
| 2022-06-08 | CVE-2010-1297 | Adobe Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 0.83 | 0.98 | Out of scope (local) | No |
| 2022-06-08 | CVE-2009-4324 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 0.82 | 0.98 | Out of scope (local) | No |
| 2022-06-08 | CVE-2009-3953 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | 0.83 | 0.99 | None yet | No |
| 2022-06-08 | CVE-2009-1862 | Adobe Acrobat and Reader, Flash Player | Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability | 0.21 | 0.74 | Out of scope (local) | No |
| 2022-06-08 | CVE-2008-0655 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Unspecified Vulnerability | 0.38 | 0.98 | None yet | No |
| 2022-06-08 | CVE-2007-5659 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Buffer Overflow Vulnerability | 0.87 | 0.98 | Out of scope (local) | No |
| 2022-05-25 | CVE-2016-1010 | Adobe Flash Player and AIR | Adobe Flash Player and AIR Integer Overflow Vulnerability | 0.19 | 0.95 | None yet | No |
| 2022-05-25 | CVE-2016-0984 | Adobe Flash Player and AIR | Adobe Flash Player and AIR Use-After-Free Vulnerability | 0.55 | 0.98 | None yet | No |
| 2022-05-25 | CVE-2015-8651 | Adobe Flash Player | Adobe Flash Player Integer Overflow Vulnerability | 0.68 | 0.98 | None yet | No |
| 2022-05-25 | CVE-2015-0310 | Adobe Flash Player | Adobe Flash Player ASLR Bypass Vulnerability | 0.15 | 0.55 | Out of scope (local) | No |
| 2022-05-25 | CVE-2014-8439 | Adobe Flash Player | Adobe Flash Player Dereferenced Pointer Vulnerability | 0.20 | 0.56 | None yet | No |
| 2022-05-25 | CVE-2014-0546 | Adobe Reader and Acrobat | Adobe Reader and Acrobat Sandbox Bypass Vulnerability | 0.22 | 0.57 | None yet | No |
| 2022-05-23 | CVE-2018-5002 | Adobe Flash Player | Adobe Flash Player Stack-based Buffer Overflow Vulnerability | 0.24 | 0.98 | Out of scope (local) | No |
| 2022-04-13 | CVE-2015-5123 | Adobe Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 0.19 | 0.56 | Out of scope (local) | No |
| 2022-04-13 | CVE-2015-5122 | Adobe Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 0.87 | 0.99 | Out of scope (local) | No |
| 2022-04-13 | CVE-2015-3113 | Adobe Flash Player | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | 1.00 | 0.99 | Out of scope (local) | No |
| 2022-04-13 | CVE-2015-0313 | Adobe Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 0.95 | 0.98 | Out of scope (local) | No |
| 2022-04-13 | CVE-2015-0311 | Adobe Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 0.86 | 0.98 | Out of scope (local) | No |
| 2022-04-13 | CVE-2014-9163 | Adobe Flash Player | Adobe Flash Player Stack-Based Buffer Overflow Vulnerability | 0.45 | 0.98 | Out of scope (local) | No |
| 2022-03-28 | CVE-2013-2729 | Adobe Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability | 0.67 | 0.98 | None yet | No |
| 2022-03-28 | CVE-2012-2034 | Adobe Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 0.08 | 0.75 | None yet | No |
| 2022-03-25 | CVE-2016-7892 | Adobe Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 0.19 | 0.55 | None yet | No |
| 2022-03-25 | CVE-2016-4171 | Adobe Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 0.20 | 0.55 | Out of scope (local) | No |
| 2022-03-25 | CVE-2010-2861 | Adobe ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | Yes |
| 2022-03-25 | CVE-2009-0927 | Adobe Reader and Acrobat | Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability | 0.97 | 0.99 | None yet | No |
| 2022-03-07 | CVE-2013-0631 | Adobe ColdFusion | Adobe ColdFusion Information Disclosure Vulnerability | 0.66 | 0.98 | None yet | No |
| 2022-03-07 | CVE-2013-0629 | Adobe ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | 0.66 | 0.97 | None yet | No |
| 2022-03-07 | CVE-2013-0625 | Adobe ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | 0.94 | 0.98 | None yet | No |
| 2022-03-07 | CVE-2009-3960 | Adobe BlazeDS | Adobe BlazeDS Information Disclosure Vulnerability | 0.90 | 0.99 | None yet | Yes |
| 2022-03-03 | CVE-2017-11292 | Adobe Flash Player | Adobe Flash Player Type Confusion Vulnerability | 0.12 | 0.53 | None yet | No |
| 2022-03-03 | CVE-2016-7855 | Adobe Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 0.25 | 0.97 | None yet | No |
| 2022-03-03 | CVE-2016-4117 | Adobe Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 0.94 | 0.99 | Out of scope (local) | Yes |
| 2022-03-03 | CVE-2016-1019 | Adobe Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 0.22 | 0.77 | Out of scope (local) | Yes |
| 2022-03-03 | CVE-2015-7645 | Adobe Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 0.65 | 0.98 | Out of scope (local) | Yes |
| 2022-03-03 | CVE-2015-5119 | Adobe Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 0.99 | 0.99 | Out of scope (local) | No |
| 2022-03-03 | CVE-2015-3043 | Adobe Flash Player | Adobe Flash Player Memory Corruption Vulnerability | 0.74 | 0.99 | Out of scope (local) | No |
| 2022-03-03 | CVE-2014-0496 | Adobe Reader and Acrobat | Adobe Reader and Acrobat Use-After-Free Vulnerability | 0.40 | 0.60 | None yet | No |
| 2022-03-03 | CVE-2013-3346 | Adobe Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | 0.79 | 0.98 | None yet | No |
| 2022-03-03 | CVE-2013-0641 | Adobe Reader | Adobe Reader Buffer Overflow Vulnerability | 0.32 | 0.59 | Out of scope (local) | No |
| 2022-03-03 | CVE-2013-0640 | Adobe Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | 0.87 | 0.99 | Out of scope (local) | No |
| 2022-03-03 | CVE-2013-0632 | Adobe ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | 0.93 | 0.98 | Nuclei · Suricata | No |
| 2022-03-03 | CVE-2012-1535 | Adobe Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | 0.70 | 0.99 | Out of scope (local) | No |
| 2022-03-03 | CVE-2011-0611 | Adobe Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | 0.99 | 0.98 | None yet | No |
| 2022-03-03 | CVE-2010-0188 | Adobe Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability | 0.88 | 0.98 | Out of scope (local) | Yes |
| 2022-03-03 | CVE-2008-2992 | Adobe Acrobat and Reader | Adobe Reader and Acrobat Input Validation Vulnerability | 1.00 | 0.98 | Out of scope (local) | Yes |
| 2022-02-15 | CVE-2022-24086 | Adobe Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | 0.99 | 0.98 | Nuclei · Suricata | No |
| 2022-02-15 | CVE-2018-15982 | Adobe Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 0.90 | 0.98 | Out of scope (local) | Yes |
| 2021-11-03 | CVE-2021-28550 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 0.52 | 0.98 | None yet | No |
| 2021-11-03 | CVE-2021-21017 | Adobe Acrobat and Reader | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability | 0.86 | 0.98 | None yet | No |
| 2021-11-03 | CVE-2018-4939 | Adobe ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 0.62 | 0.88 | None yet | No |
| 2021-11-03 | CVE-2018-4878 | Adobe Flash Player | Adobe Flash Player Use-After-Free Vulnerability | 0.90 | 0.99 | Out of scope (local) | Yes |
| 2021-11-03 | CVE-2018-15961 | Adobe ColdFusion | Adobe ColdFusion Unrestricted File Upload Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | No |
Industry partners
