Vulnerabilities by vendor · updated on every deploy
Adobe vulnerabilities: exploited CVEs and our analysis
Adobe has 82 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 7 of them added in the last 12 months and 11 known to be used in ransomware campaigns. Below: the 3 analyses Zero Hunt Research published on Adobe products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
82
CVEs in CISA KEV
7
Added in the last 12 months
11
Known ransomware use
3
Zero Hunt analyses
Products with the most KEV entries: Flash Player (33) · ColdFusion (16) · Acrobat and Reader (13) · Reader and Acrobat (8) · Commerce and Magento Open Source (2) · Flash Player and AIR (2)
Our analysis of Adobe vulnerabilities
2026-09-08
CVE-2026-75650 StyleSmuggler: Magento Zero-Day RCE Planting BackdoorsCVE-2026-75650: CVSS 10 unauthenticated RCE in Magento and Adobe Commerce, exploited since 4 September to plant a Rust backdoor beaconing as NTP.
2026-08-03
Adobe Campaign Classic CVE-2026-48449: the Same CVSS 10.0, a Third TimeAdobe shipped its third CVSS 10.0 authorization bypass in Campaign Classic in 50 days. The build that fixed you in June is the build that failed you in July — and Adobe is about to stop counting them separately.
2026-07-04
ColdFusion CVE-2026-48282: Exploited Within Hours of the PatchAdobe shipped six CVSS 10.0 ColdFusion flaws on July 1. Within hours CVE-2026-48282 was under attack — and the file-read window before you patch is exactly what most defenders never see.
Latest 40 of 82 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-09-24 | CVE-2026-71362 | Commerce and Magento Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. | 2026-09-27 | Forensic triage | — |
| 2026-09-08 | CVE-2026-75650 | Commerce and Magento Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. | 2026-09-11 | Forensic triage | Read → |
| 2026-07-07 | CVE-2026-48282 | ColdFusion Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. | 2026-07-10 | Forensic triage | Read → |
| 2026-05-20 | CVE-2009-3459 | Acrobat and Reader Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption. | 2026-06-03 | — | |
| 2026-04-13 | CVE-2026-34621 | Acrobat and Reader Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution. | 2026-04-27 | — | |
| 2026-04-13 | CVE-2020-9715 | Acrobat Adobe Acrobat contains a use-after-free vulnerability that allows for code execution | 2026-04-27 | — | |
| 2025-10-24 | CVE-2025-54236 | Commerce and Magento Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. | 2025-11-14 | — | |
| 2025-10-15 | CVE-2025-54253 | Experience Manager (AEM) Forms Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution. | 2025-11-05 | — | |
| 2025-02-24 | CVE-2017-3066 | ColdFusion Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution. | 2025-03-17 | — | |
| 2024-12-16 | CVE-2024-20767 | ColdFusion Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. | 2025-01-06 | — | |
| 2024-09-17 | CVE-2014-0502 | Flash Player Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code. | 2024-10-08 | — | |
| 2024-09-17 | CVE-2014-0497 | Flash Player Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code. | 2024-10-08 | — | |
| 2024-09-17 | CVE-2013-0648 | Flash Player Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content. | 2024-10-08 | — | |
| 2024-09-17 | CVE-2013-0643 | Flash Player Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content. | 2024-10-08 | — | |
| 2024-07-17 | CVE-2024-34102 | Commerce and Magento Open Source Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. | 2024-08-07 | — | |
| 2024-01-08 | CVE-2023-38203 | ColdFusion Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. | 2024-01-29 | Ransomware | — |
| 2024-01-08 | CVE-2023-29300 | ColdFusion Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. | 2024-01-29 | Ransomware | — |
| 2023-10-10 | CVE-2023-21608 | Acrobat and Reader Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user. | 2023-10-31 | — | |
| 2023-09-14 | CVE-2023-26369 | Acrobat and Reader Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution. | 2023-10-05 | — | |
| 2023-08-21 | CVE-2023-26359 | ColdFusion Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. | 2023-09-11 | — | |
| 2023-07-20 | CVE-2023-38205 | ColdFusion Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. | 2023-08-10 | — | |
| 2023-07-20 | CVE-2023-29298 | ColdFusion Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. | 2023-08-10 | — | |
| 2023-03-15 | CVE-2023-26360 | ColdFusion Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. | 2023-04-05 | — | |
| 2022-06-08 | CVE-2018-4990 | Acrobat and Reader Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution. | 2022-06-22 | — | |
| 2022-06-08 | CVE-2012-5054 | Flash Player Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments. | 2022-06-22 | — | |
| 2022-06-08 | CVE-2012-0767 | Flash Player Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML. | 2022-06-22 | — | |
| 2022-06-08 | CVE-2012-0754 | Flash Player Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). | 2022-06-22 | — | |
| 2022-06-08 | CVE-2011-2462 | Reader and Acrobat The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS). | 2022-06-22 | — | |
| 2022-06-08 | CVE-2011-0609 | Flash Player Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). | 2022-06-22 | — | |
| 2022-06-08 | CVE-2010-2883 | Acrobat and Reader Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). | 2022-06-22 | — | |
| 2022-06-08 | CVE-2010-1297 | Flash Player Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). | 2022-06-22 | — | |
| 2022-06-08 | CVE-2009-4324 | Acrobat and Reader Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file. | 2022-06-22 | — | |
| 2022-06-08 | CVE-2009-3953 | Acrobat and Reader Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution. | 2022-06-22 | — | |
| 2022-06-08 | CVE-2009-1862 | Acrobat and Reader, Flash Player Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS). | 2022-06-22 | — | |
| 2022-06-08 | CVE-2008-0655 | Acrobat and Reader Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times. | 2022-06-22 | — | |
| 2022-06-08 | CVE-2007-5659 | Acrobat and Reader Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods. | 2022-06-22 | — | |
| 2022-05-25 | CVE-2016-1010 | Flash Player and AIR Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code. | 2022-06-15 | — | |
| 2022-05-25 | CVE-2016-0984 | Flash Player and AIR Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code. | 2022-06-15 | — | |
| 2022-05-25 | CVE-2015-8651 | Flash Player Integer overflow in Adobe Flash Player allows attackers to execute code. | 2022-06-15 | — | |
| 2022-05-25 | CVE-2015-0310 | Flash Player Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism. | 2022-06-15 | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Adobe vulnerabilities are in the CISA KEV catalog?
82 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-09-24. 7 were added in the last 12 months.
Which Adobe products have the most exploited vulnerabilities?
By KEV entries: Flash Player (33), ColdFusion (16), Acrobat and Reader (13), Reader and Acrobat (8), Commerce and Magento Open Source (2), Flash Player and AIR (2).
Are Adobe vulnerabilities used in ransomware attacks?
CISA marks 11 of the 82 Adobe entries as known to be used in ransomware campaigns. The table flags them.
Is the next Adobe CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5