Cyberfeed6 › Vendors › Adobe
CISA lists 83 Adobe vulnerabilities as exploited in real attacks, and 11 of them are known to be used in ransomware campaigns. Most entries concern Flash Player, ColdFusion, Acrobat and Reader, Reader and Acrobat.
Showing the 40 most recently added of 83. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2026-48356Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | Commerce and Magento | 2026-10-27 | Critical (9.3) | No | Vendor notice |
| CVE-2026-71362Adobe Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | 2026-09-24 | Critical (9.1) | No | Vendor notice |
| CVE-2026-75650Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | Commerce and Magento | 2026-09-08 | Critical (10.0) | No | Vendor notice |
| CVE-2026-48282Adobe ColdFusion Path Traversal Vulnerability | ColdFusion | 2026-07-07 | Critical (10.0) | No | Vendor notice |
| CVE-2009-3459Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | Acrobat and Reader | 2026-05-20 | High (8.8) | No | Vendor notice |
| CVE-2026-34621Adobe Acrobat and Reader Prototype Pollution Vulnerability | Acrobat and Reader | 2026-04-13 | High (8.6) | No | Vendor notice |
| CVE-2020-9715Adobe Acrobat Use-After-Free Vulnerability | Acrobat | 2026-04-13 | High (7.8) | No | Vendor notice |
| CVE-2025-54236Adobe Commerce and Magento Improper Input Validation Vulnerability | Commerce and Magento | 2025-10-24 | Critical (9.1) | No | Vendor notice |
| CVE-2025-54253Adobe Experience Manager Forms Code Execution Vulnerability | Experience Manager (AEM) Forms | 2025-10-15 | Critical (10.0) | No | Vendor notice |
| CVE-2017-3066Adobe ColdFusion Deserialization Vulnerability | ColdFusion | 2025-02-24 | Critical (9.8) | No | Vendor notice |
| CVE-2024-20767Adobe ColdFusion Improper Access Control Vulnerability | ColdFusion | 2024-12-16 | High (7.4) | No | Vendor notice |
| CVE-2014-0502Adobe Flash Player Double Free Vulnerablity | Flash Player | 2024-09-17 | High (8.8) | No | Vendor notice |
| CVE-2014-0497Adobe Flash Player Integer Underflow Vulnerablity | Flash Player | 2024-09-17 | High (8.8) | No | Vendor notice |
| CVE-2013-0648Adobe Flash Player Code Execution Vulnerability | Flash Player | 2024-09-17 | High (8.8) | No | Vendor notice |
| CVE-2013-0643Adobe Flash Player Incorrect Default Permissions Vulnerability | Flash Player | 2024-09-17 | High (8.8) | No | Vendor notice |
| CVE-2024-34102Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | Commerce and Magento Open Source | 2024-07-17 | Critical (9.8) | No | Vendor notice |
| CVE-2023-38203Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | ColdFusion | 2024-01-08 | Critical (9.8) | Yes | Vendor notice |
| CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | ColdFusion | 2024-01-08 | Critical (9.8) | Yes | Vendor notice |
| CVE-2023-21608Adobe Acrobat and Reader Use-After-Free Vulnerability | Acrobat and Reader | 2023-10-10 | High (7.8) | No | Vendor notice |
| CVE-2023-26369Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | Acrobat and Reader | 2023-09-14 | High (7.8) | No | Vendor notice |
| CVE-2023-26359Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | ColdFusion | 2023-08-21 | Critical (9.8) | No | Vendor notice |
| CVE-2023-38205Adobe ColdFusion Improper Access Control Vulnerability | ColdFusion | 2023-07-20 | High (7.5) | No | Vendor notice |
| CVE-2023-29298Adobe ColdFusion Improper Access Control Vulnerability | ColdFusion | 2023-07-20 | High (7.5) | No | Vendor notice |
| CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | ColdFusion | 2023-03-15 | High (8.6) | No | Vendor notice |
| CVE-2018-4990Adobe Acrobat and Reader Double Free Vulnerability | Acrobat and Reader | 2022-06-08 | High (8.8) | No | |
| CVE-2012-5054Adobe Flash Player Integer Overflow Vulnerability | Flash Player | 2022-06-08 | High (8.8) | No | |
| CVE-2012-0767Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | Flash Player | 2022-06-08 | Medium (6.1) | No | |
| CVE-2012-0754Adobe Flash Player Memory Corruption Vulnerability | Flash Player | 2022-06-08 | High (7.8) | No | |
| CVE-2011-2462Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability | Reader and Acrobat | 2022-06-08 | High (8.8) | No | |
| CVE-2011-0609Adobe Flash Player Unspecified Vulnerability | Flash Player | 2022-06-08 | High (7.8) | No | |
| CVE-2010-2883Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | Acrobat and Reader | 2022-06-08 | High (7.3) | No | |
| CVE-2010-1297Adobe Flash Player Memory Corruption Vulnerability | Flash Player | 2022-06-08 | High (7.8) | No | |
| CVE-2009-4324Adobe Acrobat and Reader Use-After-Free Vulnerability | Acrobat and Reader | 2022-06-08 | High (7.8) | No | |
| CVE-2009-3953Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | Acrobat and Reader | 2022-06-08 | High (8.8) | No | |
| CVE-2009-1862Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability | Acrobat and Reader, Flash Player | 2022-06-08 | High (7.8) | No | |
| CVE-2008-0655Adobe Acrobat and Reader Unspecified Vulnerability | Acrobat and Reader | 2022-06-08 | High (8.8) | No | |
| CVE-2007-5659Adobe Acrobat and Reader Buffer Overflow Vulnerability | Acrobat and Reader | 2022-06-08 | High (7.8) | No | |
| CVE-2016-1010Adobe Flash Player and AIR Integer Overflow Vulnerability | Flash Player and AIR | 2022-05-25 | High (8.8) | No | |
| CVE-2016-0984Adobe Flash Player and AIR Use-After-Free Vulnerability | Flash Player and AIR | 2022-05-25 | High (8.8) | No | |
| CVE-2015-8651Adobe Flash Player Integer Overflow Vulnerability | Flash Player | 2022-05-25 | High (8.8) | No |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.