Vendor dossier / #4
Adobe vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 81 Adobe vulnerabilities as of catalog 2026.09.23, 4.7% of all 1,721 entries and rank 4 of 283 vendors. The first was added on 2021-11-03 and the most recent on 2026-09-08; 11 are flagged as used in ransomware campaigns.
- KEV entries
- 814.7% of catalog
- Last 90 days
- +2added
- Ransomware: known
- 1113.6%
- Products
- 13distinct
- First added
- 2021-11-03
- Latest added
- 2026-09-08
- Median days to due
- 21
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 5 |
| 2022 | 54 |
| 2023 | 6 |
| 2024 | 8 |
| 2025 | 3 |
| 2026 | 5 |
QCommon questions
How many Adobe vulnerabilities are in CISA KEV?
81, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 4.7% of the catalog.
Which Adobe product has the most KEV entries?
Flash Player, with 33 entries. 13 products appear in total.
How many Adobe KEV vulnerabilities are linked to ransomware?
11 of 81 (13.6%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest Adobe vulnerability added to KEV?
2026-09-08 (CVE-2026-75650).
What is the most common weakness in Adobe KEV entries?
CWE-416 (Use after free), listed on 11 entries.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| Flash Player | 33 | 40.7% |
| ColdFusion | 16 | 19.8% |
| Acrobat and Reader | 13 | 16% |
| Reader and Acrobat | 8 | 9.9% |
| Commerce and Magento Open Source | 2 | 2.5% |
| Flash Player and AIR | 2 | 2.5% |
| Commerce and Magento | 1 | 1.2% |
| Acrobat | 1 | 1.2% |
| Commerce and Magento | 1 | 1.2% |
| Experience Manager (AEM) Forms | 1 | 1.2% |
| Acrobat and Reader, Flash Player | 1 | 1.2% |
| BlazeDS | 1 | 1.2% |
| Reader | 1 | 1.2% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-416 Use after free | 11 | 13.6% |
| CWE-119 Memory buffer bounds error | 10 | 12.3% |
| CWE-787 Out-of-bounds write | 7 | 8.6% |
| CWE-502 Unsafe deserialization | 5 | 6.2% |
| CWE-284 Improper access control | 4 | 4.9% |
| CWE-20 Improper input validation | 3 | 3.7% |
| CWE-399 Resource management errors (category) | 3 | 3.7% |
| CWE-264 Permissions and access controls (category) | 3 | 3.7% |
| CWE-189 | 3 | 3.7% |
| CWE-22 Path traversal | 2 | 2.5% |
| CWE-94 Code injection | 2 | 2.5% |
| CWE-200 Information exposure | 2 | 2.5% |
| No CWE listed | 13 | 16% |
EAll 81 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2026-75650 | Commerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | Unknown | CWE-1336 | ||
| CVE-2026-48282 | ColdFusion | Adobe ColdFusion Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2009-3459 | Acrobat and Reader | Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2026-34621 | Acrobat and Reader | Adobe Acrobat and Reader Prototype Pollution Vulnerability | Unknown | CWE-1321 | ||
| CVE-2020-9715 | Acrobat | Adobe Acrobat Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2025-54236 | Commerce and Magento | Adobe Commerce and Magento Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2025-54253 | Experience Manager (AEM) Forms | Adobe Experience Manager Forms Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2017-3066 | ColdFusion | Adobe ColdFusion Deserialization Vulnerability | Unknown | CWE-502 | ||
| CVE-2024-20767 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2014-0502 | Flash Player | Adobe Flash Player Double Free Vulnerablity | Unknown | CWE-399 | ||
| CVE-2014-0497 | Flash Player | Adobe Flash Player Integer Underflow Vulnerablity | Unknown | CWE-191 | ||
| CVE-2013-0648 | Flash Player | Adobe Flash Player Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2013-0643 | Flash Player | Adobe Flash Player Incorrect Default Permissions Vulnerability | Unknown | CWE-264 | ||
| CVE-2024-34102 | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | Unknown | CWE-611 | ||
| CVE-2023-38203 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2023-29300 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2023-21608 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-26369 | Acrobat and Reader | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-26359 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2023-38205 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2023-29298 | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2023-26360 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Unknown | CWE-284 | ||
| CVE-2018-4990 | Acrobat and Reader | Adobe Acrobat and Reader Double Free Vulnerability | Unknown | CWE-415 | ||
| CVE-2012-5054 | Flash Player | Adobe Flash Player Integer Overflow Vulnerability | Unknown | CWE-189 | ||
| CVE-2012-0767 | Flash Player | Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2012-0754 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2011-2462 | Reader and Acrobat | Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2011-0609 | Flash Player | Adobe Flash Player Unspecified Vulnerability | Unknown | none listed | ||
| CVE-2010-2883 | Acrobat and Reader | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2010-1297 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2009-4324 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | Unknown | CWE-399 | ||
| CVE-2009-3953 | Acrobat and Reader | Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | Unknown | CWE-119 | ||
| CVE-2009-1862 | Acrobat and Reader, Flash Player | Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability | Unknown | CWE-94 | ||
| CVE-2008-0655 | Acrobat and Reader | Adobe Acrobat and Reader Unspecified Vulnerability | Unknown | none listed | ||
| CVE-2007-5659 | Acrobat and Reader | Adobe Acrobat and Reader Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2016-1010 | Flash Player and AIR | Adobe Flash Player and AIR Integer Overflow Vulnerability | Unknown | CWE-190 | ||
| CVE-2016-0984 | Flash Player and AIR | Adobe Flash Player and AIR Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2015-8651 | Flash Player | Adobe Flash Player Integer Overflow Vulnerability | Unknown | CWE-189 | ||
| CVE-2015-0310 | Flash Player | Adobe Flash Player ASLR Bypass Vulnerability | Unknown | CWE-264 | ||
| CVE-2014-8439 | Flash Player | Adobe Flash Player Dereferenced Pointer Vulnerability | Unknown | CWE-119 | ||
| CVE-2014-0546 | Reader and Acrobat | Adobe Reader and Acrobat Sandbox Bypass Vulnerability | Unknown | none listed | ||
| CVE-2018-5002 | Flash Player | Adobe Flash Player Stack-based Buffer Overflow Vulnerability | Unknown | CWE-787 | ||
| CVE-2015-5123 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2015-5122 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2015-3113 | Flash Player | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2015-0313 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2015-0311 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2014-9163 | Flash Player | Adobe Flash Player Stack-Based Buffer Overflow Vulnerability | Unknown | none listed | ||
| CVE-2013-2729 | Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability | Unknown | CWE-189 | ||
| CVE-2012-2034 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2016-7892 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2016-4171 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2010-2861 | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | Known | CWE-22 | ||
| CVE-2009-0927 | Reader and Acrobat | Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability | Unknown | CWE-20 | ||
| CVE-2013-0631 | ColdFusion | Adobe ColdFusion Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2013-0629 | ColdFusion | Adobe ColdFusion Directory Traversal Vulnerability | Unknown | CWE-264 | ||
| CVE-2013-0625 | ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | Unknown | CWE-255 | ||
| CVE-2009-3960 | BlazeDS | Adobe BlazeDS Information Disclosure Vulnerability | Known | none listed | ||
| CVE-2017-11292 | Flash Player | Adobe Flash Player Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2016-7855 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2016-4117 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | Known | none listed | ||
| CVE-2016-1019 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | Known | none listed | ||
| CVE-2015-7645 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | Known | none listed | ||
| CVE-2015-5119 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Unknown | CWE-119 | ||
| CVE-2015-3043 | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2014-0496 | Reader and Acrobat | Adobe Reader and Acrobat Use-After-Free Vulnerability | Unknown | CWE-399 | ||
| CVE-2013-3346 | Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2013-0641 | Reader | Adobe Reader Buffer Overflow Vulnerability | Unknown | CWE-120 | ||
| CVE-2013-0640 | Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2013-0632 | ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | Unknown | CWE-200 | ||
| CVE-2012-1535 | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2011-0611 | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | Unknown | CWE-843 | ||
| CVE-2010-0188 | Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability | Known | CWE-94 | ||
| CVE-2008-2992 | Acrobat and Reader | Adobe Reader and Acrobat Input Validation Vulnerability | Known | CWE-119 | ||
| CVE-2022-24086 | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2018-15982 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Known | CWE-416 | ||
| CVE-2021-28550 | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-21017 | Acrobat and Reader | Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2018-4939 | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2018-4878 | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Known | CWE-416 | ||
| CVE-2018-15961 | ColdFusion | Adobe ColdFusion Unrestricted File Upload Vulnerability | Unknown | CWE-434 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 81 Adobe vulnerabilities (4.7% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/adobe/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about Adobe beyond this data.