CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Adobe Flash Player Arbitrary Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
Description
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
Affected products
adobe: flash player desktop runtime; apple: mac os x; microsoft: windows; adobe: flash player; google: chrome os; linux: linux kernel; microsoft: windows 10; microsoft: windows 8.1; adobe: air desktop runtime; adobe: air sdk; apple: iphone os; google: android; adobe: air sdk \& compiler
References10
- blogs.adobe.com/psirt/?p=1330 Broken LinkVendor Advisory
- docs.microsoft.com/en-us/security-updates/securitybulletins/201… PatchThird Party AdvisoryVendor Advisory
- helpx.adobe.com/security/products/flash-player/apsa16-01.html Vendor Advisory
- helpx.adobe.com/security/products/flash-player/apsb16-10.html Vendor Advisory
- blogs.adobe.com/psirt/?p=1330 Broken LinkVendor Advisory
- docs.microsoft.com/en-us/security-updates/securitybulletins/201… PatchThird Party AdvisoryVendor Advisory
- helpx.adobe.com/security/products/flash-player/apsa16-01.html Vendor Advisory
- helpx.adobe.com/security/products/flash-player/apsb16-10.html Vendor Advisory
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.… Broken Link
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.… Broken Link
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 22% percentile: 98 · as of 8 November 2026
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.