Skip to content
Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

Adobe: actively exploited vulnerabilities

82 vulnerabilities in Adobe products (Flash Player, Acrobat / Reader, ColdFusion…) are in CISA’s catalog of exploited vulnerabilities, 3 of them added in the last 90 days. Last added: September 24, 2026.

Adobe security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Adobe category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Follow a single Adobe product (Flash Player, Acrobat / Reader…) rather than the whole brand.

  • Flash Player36 vulnerabilities, Browsers
  • Acrobat / Reader23 vulnerabilities, Office and PDF
  • ColdFusion16 vulnerabilities, Web servers
  • Commerce (Magento)5 vulnerabilities, CMS and websites
  • BlazeDS1 vulnerability, Frameworks
  • Experience Manager (AEM)1 vulnerability, CMS and websites

Name used by CISA: Adobe. Product families: indicative classification by this site.

Pace of additions

Number of Adobe vulnerabilities added to CISA’s KEV catalog, per 30-day period (the last one, still in progress, ends on October 3, 2026). Source: CISA KEV catalog.
Catalog additions per 30-day period
PeriodVulnerabilities added
Sep 9, 2025 to Oct 8, 20250
Oct 9, 2025 to Nov 7, 20252
Nov 8, 2025 to Dec 7, 20250
Dec 8, 2025 to Jan 6, 20260
Jan 7, 2026 to Feb 5, 20260
Feb 6, 2026 to Mar 7, 20260
Mar 8, 2026 to Apr 6, 20260
Apr 7, 2026 to May 6, 20262
May 7, 2026 to Jun 5, 20261
Jun 6, 2026 to Jul 5, 20260
Jul 6, 2026 to Aug 4, 20261
Aug 5, 2026 to Sep 3, 20260
Sep 4, 2026 to Oct 3, 2026 (in progress)2

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Adobe list.

  1. Rank 1

    Adobe Commerce (Magento)CVE-2026-71362

    Adobe Commerce and Magento Incorrect Authorization Vulnerability

    Recently addedHunt for compromise (CISA)

    CVSS severity 9.1critical

    Added Sep 24, 2026

  2. Rank 2

    Adobe Commerce (Magento)CVE-2026-75650

    Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

    Recently addedHunt for compromise (CISA)

    CVSS severity 10.0critical

    Added Sep 8, 2026

  3. Rank 3

    Adobe ColdFusionCVE-2026-48282

    Adobe ColdFusion Path Traversal Vulnerability

    Hunt for compromise (CISA)

    CVSS severity 10.0critical

    Added Jul 7, 2026

  4. Rank 4

    Adobe Experience Manager (AEM)CVE-2025-54253

    Adobe Experience Manager Forms Code Execution Vulnerability

    CVSS severity 10.0critical

    Added Oct 15, 2025

  5. Rank 5

    Adobe Commerce (Magento)CVE-2025-54236

    Adobe Commerce and Magento Improper Input Validation Vulnerability

    CVSS severity 9.1critical

    Added Oct 24, 2025

  6. Rank 6

    Adobe Acrobat / ReaderCVE-2009-3459

    Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

    CVE from 2009, added in 2026

    CVSS severity 8.8high

    Added May 20, 2026

  7. Rank 7

    Adobe Acrobat / ReaderCVE-2026-34621

    Adobe Acrobat and Reader Prototype Pollution Vulnerability

    CVSS severity 8.6high

    Added Apr 13, 2026

  8. Rank 8

    Adobe Acrobat / ReaderCVE-2020-9715

    Adobe Acrobat Use-After-Free Vulnerability

    CVE from 2020, added in 2026

    CVSS severity 7.8high

    Added Apr 13, 2026

  9. Rank 9

    Adobe ColdFusionCVE-2017-3066

    Adobe ColdFusion Deserialization Vulnerability

    CVE from 2017, added in 2025

    CVSS severity 9.8critical

    Added Feb 24, 2025

  10. Rank 10

    Adobe Commerce (Magento)CVE-2024-34102

    Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

    CVSS severity 9.8critical

    Added Jul 17, 2024

Show 37 more vulnerabilities
  1. Rank 11

    Adobe ColdFusionCVE-2023-29300

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Jan 8, 2024

  2. Rank 12

    Adobe ColdFusionCVE-2023-38203

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Jan 8, 2024

  3. Rank 13

    Adobe ColdFusionCVE-2023-26359

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    CVSS severity 9.8critical

    Added Aug 21, 2023

  4. Rank 14

    Adobe ColdFusionCVE-2023-26360

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    CVSS severity 9.8critical

    Added Mar 15, 2023

  5. Rank 15

    Adobe Acrobat / ReaderCVE-2011-2462

    Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability

    CVE from 2011, added in 2022

    CVSS severity 9.8critical

    Added Jun 8, 2022

  6. Rank 16

    Adobe Acrobat / ReaderCVE-2014-0546

    Adobe Reader and Acrobat Sandbox Bypass Vulnerability

    CVE from 2014, added in 2022

    CVSS severity 9.8critical

    Added May 25, 2022

  7. Rank 17

    Adobe Acrobat / ReaderCVE-2013-2729

    Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 9.8critical

    Added Mar 28, 2022

  8. Rank 18

    Adobe ColdFusionCVE-2010-2861

    Adobe ColdFusion Directory Traversal Vulnerability

    RansomwareCVE from 2010, added in 2022

    CVSS severity 9.8critical

    Added Mar 25, 2022

  9. Rank 19

    Adobe ColdFusionCVE-2013-0625

    Adobe ColdFusion Authentication Bypass Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 9.8critical

    Added Mar 7, 2022

  10. Rank 20

    Adobe ColdFusionCVE-2013-0632

    Adobe ColdFusion Authentication Bypass Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  11. Rank 21

    Adobe Acrobat / ReaderCVE-2013-3346

    Adobe Reader and Acrobat Memory Corruption Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  12. Rank 22

    Adobe Commerce (Magento)CVE-2022-24086

    Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

    CVSS severity 9.8critical

    Added Feb 15, 2022

  13. Rank 23

    Adobe ColdFusionCVE-2018-15961

    Adobe ColdFusion Unrestricted File Upload Vulnerability

    CVE from 2018, added in 2021

    CVSS severity 9.8critical

    Added Nov 3, 2021

  14. Rank 24

    Adobe ColdFusionCVE-2018-4939

    Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

    CVE from 2018, added in 2021

    CVSS severity 9.8critical

    Added Nov 3, 2021

  15. Rank 25

    Adobe Acrobat / ReaderCVE-2008-0655

    Adobe Acrobat and Reader Unspecified Vulnerability

    CVE from 2008, added in 2022

    CVSS severity 8.8high

    Added Jun 8, 2022

  16. Rank 26

    Adobe Acrobat / ReaderCVE-2009-3953

    Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 8.8high

    Added Jun 8, 2022

  17. Rank 27

    Adobe Acrobat / ReaderCVE-2018-4990

    Adobe Acrobat and Reader Double Free Vulnerability

    CVE from 2018, added in 2022

    CVSS severity 8.8high

    Added Jun 8, 2022

  18. Rank 28

    Adobe Acrobat / ReaderCVE-2009-0927

    Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 8.8high

    Added Mar 25, 2022

  19. Rank 29

    Adobe Acrobat / ReaderCVE-2014-0496

    Adobe Reader and Acrobat Use-After-Free Vulnerability

    CVE from 2014, added in 2022

    CVSS severity 8.8high

    Added Mar 3, 2022

  20. Rank 30

    Adobe Acrobat / ReaderCVE-2021-21017

    Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

    CVSS severity 8.8high

    Added Nov 3, 2021

  21. Rank 31

    Adobe Acrobat / ReaderCVE-2021-28550

    Adobe Acrobat and Reader Use-After-Free Vulnerability

    CVSS severity 8.8high

    Added Nov 3, 2021

  22. Rank 32

    Adobe Acrobat / ReaderCVE-2023-21608

    Adobe Acrobat and Reader Use-After-Free Vulnerability

    CVSS severity 7.8high

    Added Oct 10, 2023

  23. Rank 33

    Adobe Acrobat / ReaderCVE-2023-26369

    Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

    CVSS severity 7.8high

    Added Sep 14, 2023

  24. Rank 34

    Adobe Acrobat / ReaderCVE-2007-5659

    Adobe Acrobat and Reader Buffer Overflow Vulnerability

    CVE from 2007, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  25. Rank 35

    Adobe Flash PlayerCVE-2009-1862

    Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  26. Rank 36

    Adobe Acrobat / ReaderCVE-2009-4324

    Adobe Acrobat and Reader Use-After-Free Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  27. Rank 37

    Adobe Acrobat / ReaderCVE-2008-2992

    Adobe Reader and Acrobat Input Validation Vulnerability

    RansomwareCVE from 2008, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  28. Rank 38

    Adobe Acrobat / ReaderCVE-2010-0188

    Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability

    RansomwareCVE from 2010, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  29. Rank 39

    Adobe Acrobat / ReaderCVE-2013-0640

    Adobe Reader and Acrobat Memory Corruption Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  30. Rank 40

    Adobe Acrobat / ReaderCVE-2013-0641

    Adobe Reader Buffer Overflow Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  31. Rank 41

    Adobe ColdFusionCVE-2023-29298

    Adobe ColdFusion Improper Access Control Vulnerability

    CVSS severity 7.5high

    Added Jul 20, 2023

  32. Rank 42

    Adobe ColdFusionCVE-2023-38205

    Adobe ColdFusion Improper Access Control Vulnerability

    CVSS severity 7.5high

    Added Jul 20, 2023

  33. Rank 43

    Adobe ColdFusionCVE-2013-0629

    Adobe ColdFusion Directory Traversal Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 7.5high

    Added Mar 7, 2022

  34. Rank 44

    Adobe ColdFusionCVE-2013-0631

    Adobe ColdFusion Information Disclosure Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 7.5high

    Added Mar 7, 2022

  35. Rank 45

    Adobe ColdFusionCVE-2024-20767

    Adobe ColdFusion Improper Access Control Vulnerability

    CVSS severity 7.4high

    Added Dec 16, 2024

  36. Rank 46

    Adobe Acrobat / ReaderCVE-2010-2883

    Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability

    CVE from 2010, added in 2022

    CVSS severity 7.3high

    Added Jun 8, 2022

  37. Rank 47

    Adobe BlazeDSCVE-2009-3960

    Adobe BlazeDS Information Disclosure Vulnerability

    RansomwareCVE from 2009, added in 2022

    CVSS severity 6.5medium

    Added Mar 7, 2022

End of life: remove

These products are no longer supported: no patch is coming. Remove them or isolate them from the network.

  1. Adobe Flash PlayerCVE-2013-0643

    Adobe Flash Player Incorrect Default Permissions Vulnerability

    End of lifeCVE from 2013, added in 2024

    CVSS severity 8.8high

    Added Sep 17, 2024

  2. Adobe Flash PlayerCVE-2013-0648

    Adobe Flash Player Code Execution Vulnerability

    End of lifeCVE from 2013, added in 2024

    CVSS severity 8.8high

    Added Sep 17, 2024

  3. Adobe Flash PlayerCVE-2014-0497

    Adobe Flash Player Integer Underflow Vulnerablity

    End of lifeCVE from 2014, added in 2024

    CVSS severity 9.8critical

    Added Sep 17, 2024

  4. Adobe Flash PlayerCVE-2014-0502

    Adobe Flash Player Double Free Vulnerablity

    End of lifeCVE from 2014, added in 2024

    CVSS severity 8.8high

    Added Sep 17, 2024

  5. Adobe Flash PlayerCVE-2010-1297

    Adobe Flash Player Memory Corruption Vulnerability

    End of lifeCVE from 2010, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  6. Adobe Flash PlayerCVE-2011-0609

    Adobe Flash Player Unspecified Vulnerability

    End of lifeCVE from 2011, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  7. Adobe Flash PlayerCVE-2012-0754

    Adobe Flash Player Memory Corruption Vulnerability

    End of lifeCVE from 2012, added in 2022

    CVSS severity 8.1high

    Added Jun 8, 2022

  8. Adobe Flash PlayerCVE-2012-0767

    Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability

    End of lifeCVE from 2012, added in 2022

    CVSS severity 6.1medium

    Added Jun 8, 2022

  9. Adobe Flash PlayerCVE-2012-5054

    Adobe Flash Player Integer Overflow Vulnerability

    End of lifeCVE from 2012, added in 2022

    CVSS severity 8.8high

    Added Jun 8, 2022

  10. Adobe Flash PlayerCVE-2014-8439

    Adobe Flash Player Dereferenced Pointer Vulnerability

    End of lifeCVE from 2014, added in 2022

    CVSS severity 8.8high

    Added May 25, 2022

Show 25 more vulnerabilities

  1. Adobe Flash PlayerCVE-2015-0310

    Adobe Flash Player ASLR Bypass Vulnerability

    End of lifeCVE from 2015, added in 2022

    CVSS severity 7.8high

    Added May 25, 2022

  2. Adobe Flash PlayerCVE-2015-8651

    Adobe Flash Player Integer Overflow Vulnerability

    End of lifeCVE from 2015, added in 2022

    CVSS severity 8.8high

    Added May 25, 2022

  3. Adobe Flash PlayerCVE-2016-0984

    Adobe Flash Player and AIR Use-After-Free Vulnerability

    End of lifeCVE from 2016, added in 2022

    CVSS severity 8.8high

    Added May 25, 2022

  4. Adobe Flash PlayerCVE-2016-1010

    Adobe Flash Player and AIR Integer Overflow Vulnerability

    End of lifeCVE from 2016, added in 2022

    CVSS severity 8.8high

    Added May 25, 2022

  5. Adobe Flash PlayerCVE-2018-5002

    Adobe Flash Player Stack-based Buffer Overflow Vulnerability

    End of lifeCVE from 2018, added in 2022

    CVSS severity 7.8high

    Added May 23, 2022

  6. Adobe Flash PlayerCVE-2014-9163

    Adobe Flash Player Stack-Based Buffer Overflow Vulnerability

    End of lifeCVE from 2014, added in 2022

    CVSS severity 7.8high

    Added Apr 13, 2022

  7. Adobe Flash PlayerCVE-2015-0311

    Adobe Flash Player Remote Code Execution Vulnerability

    End of lifeCVE from 2015, added in 2022

    CVSS severity 9.8critical

    Added Apr 13, 2022

  8. Adobe Flash PlayerCVE-2015-0313

    Adobe Flash Player Use-After-Free Vulnerability

    End of lifeCVE from 2015, added in 2022

    CVSS severity 9.8critical

    Added Apr 13, 2022

  9. Adobe Flash PlayerCVE-2015-3113

    Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

    End of lifeCVE from 2015, added in 2022

    CVSS severity 9.8critical

    Added Apr 13, 2022

  10. Adobe Flash PlayerCVE-2015-5122

    Adobe Flash Player Use-After-Free Vulnerability

    End of lifeCVE from 2015, added in 2022

    CVSS severity 9.8critical

    Added Apr 13, 2022

  11. Adobe Flash PlayerCVE-2015-5123

    Adobe Flash Player Use-After-Free Vulnerability

    End of lifeCVE from 2015, added in 2022

    CVSS severity 9.8critical

    Added Apr 13, 2022

  12. Adobe Flash PlayerCVE-2012-2034

    Adobe Flash Player Memory Corruption Vulnerability

    End of lifeCVE from 2012, added in 2022

    CVSS severity 7.5high

    Added Mar 28, 2022

  13. Adobe Flash PlayerCVE-2016-4171

    Adobe Flash Player Remote Code Execution Vulnerability

    End of lifeCVE from 2016, added in 2022

    CVSS severity 9.8critical

    Added Mar 25, 2022

  14. Adobe Flash PlayerCVE-2016-7892

    Adobe Flash Player Use-After-Free Vulnerability

    End of lifeCVE from 2016, added in 2022

    CVSS severity 8.8high

    Added Mar 25, 2022

  15. Adobe Flash PlayerCVE-2011-0611

    Adobe Flash Player Remote Code Execution Vulnerability

    End of lifeCVE from 2011, added in 2022

    CVSS severity 8.8high

    Added Mar 3, 2022

  16. Adobe Flash PlayerCVE-2012-1535

    Adobe Flash Player Arbitrary Code Execution Vulnerability

    End of lifeCVE from 2012, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  17. Adobe Flash PlayerCVE-2015-3043

    Adobe Flash Player Memory Corruption Vulnerability

    End of lifeCVE from 2015, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  18. Adobe Flash PlayerCVE-2015-5119

    Adobe Flash Player Use-After-Free Vulnerability

    End of lifeCVE from 2015, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  19. Adobe Flash PlayerCVE-2015-7645

    Adobe Flash Player Arbitrary Code Execution Vulnerability

    RansomwareEnd of lifeCVE from 2015, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  20. Adobe Flash PlayerCVE-2016-1019

    Adobe Flash Player Arbitrary Code Execution Vulnerability

    RansomwareEnd of lifeCVE from 2016, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  21. Adobe Flash PlayerCVE-2016-4117

    Adobe Flash Player Arbitrary Code Execution Vulnerability

    RansomwareEnd of lifeCVE from 2016, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  22. Adobe Flash PlayerCVE-2016-7855

    Adobe Flash Player Use-After-Free Vulnerability

    End of lifeCVE from 2016, added in 2022

    CVSS severity 8.8high

    Added Mar 3, 2022

  23. Adobe Flash PlayerCVE-2017-11292

    Adobe Flash Player Type Confusion Vulnerability

    End of lifeCVE from 2017, added in 2022

    CVSS severity 8.8high

    Added Mar 3, 2022

  24. Adobe Flash PlayerCVE-2018-15982

    Adobe Flash Player Use-After-Free Vulnerability

    RansomwareEnd of lifeCVE from 2018, added in 2022

    CVSS severity 7.8high

    Added Feb 15, 2022

  25. Adobe Flash PlayerCVE-2018-4878

    Adobe Flash Player Use-After-Free Vulnerability

    RansomwareEnd of lifeCVE from 2018, added in 2021

    CVSS severity 7.8high

    Added Nov 3, 2021

Follow and verify

Get new Adobe vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.