CISA KEV by vendor
Adobe vulnerabilities in the CISA KEV catalogue
83 Adobe entries in CISA's Known Exploited Vulnerabilities catalogue, 11 of them (13 percent) known to have been used in ransomware campaigns. First added 3 November 2021, latest 27 October 2026.
Data status: a source is stale
Last synced CISA catalogue version 2026.11.04 (released 4 November 2026) 1,768 entries Updated manually
83entries, 4.7% of the catalogue
11known ransomware use
0added in the last 7 days
1federal due date in the next 14 days
Products
| Product, as CISA names it | Entries |
|---|---|
| Flash Player | 33 |
| ColdFusion | 16 |
| Acrobat and Reader | 13 |
| Reader and Acrobat | 8 |
| Commerce and Magento | 4 |
| Commerce and Magento Open Source | 2 |
| Flash Player and AIR | 2 |
| Acrobat | 1 |
| Experience Manager (AEM) Forms | 1 |
| Acrobat and Reader, Flash Player | 1 |
| BlazeDS | 1 |
| Reader | 1 |
Latest additions
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-48356 | Commerce and Magento | 2026-10-27 | 2026-11-10 due soon | Unknown | 9.3 Critical | 47.4% | Not auto, total | 3 days + triage |
| CVE-2026-71362 | Commerce and Magento | 2026-09-24 | 2026-09-27 | Unknown | 9.1 Critical | 90.4% | Auto, total | 3 days + triage |
| CVE-2026-75650 | Commerce and Magento | 2026-09-08 | 2026-09-11 | Unknown | 10.0 Critical | 3.9% | Auto, total | 3 days + triage |
| CVE-2026-48282 | ColdFusion | 2026-07-07 | 2026-07-10 | Unknown | 10.0 Critical | 42.3% | Auto, total | 3 days + triage |
| CVE-2009-3459 | Acrobat and Reader | 2026-05-20 | 2026-06-03 | Unknown | 8.8 High | 86.5% | Not auto, total | 3 days + triage |
| CVE-2026-34621 | Acrobat and Reader | 2026-04-13 | 2026-04-27 | Unknown | 8.6 High | 7.2% | Not auto, total | 3 days + triage |
| CVE-2020-9715 | Acrobat | 2026-04-13 | 2026-04-27 | Unknown | 7.8 High | 33.2% | Not auto, total | 3 days + triage |
| CVE-2025-54236 | Commerce and Magento | 2025-10-24 | 2025-11-14 | Unknown | 9.1 Critical | 95.3% | Auto, total | 3 days + triage |
| CVE-2025-54253 | Experience Manager (AEM) Forms | 2025-10-15 | 2025-11-05 | Unknown | 10.0 Critical | 88.7% | Auto, total | 3 days + triage |
| CVE-2017-3066 | ColdFusion | 2025-02-24 | 2025-03-17 | Unknown | 9.8 Critical | 90.5% | Auto, total | 3 days + triage |
All 83 entries
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-48356 | Commerce and Magento | 2026-10-27 | 2026-11-10 due soon | Unknown | 9.3 Critical | 47.4% | Not auto, total | 3 days + triage |
| CVE-2026-71362 | Commerce and Magento | 2026-09-24 | 2026-09-27 | Unknown | 9.1 Critical | 90.4% | Auto, total | 3 days + triage |
| CVE-2026-75650 | Commerce and Magento | 2026-09-08 | 2026-09-11 | Unknown | 10.0 Critical | 3.9% | Auto, total | 3 days + triage |
| CVE-2026-48282 | ColdFusion | 2026-07-07 | 2026-07-10 | Unknown | 10.0 Critical | 42.3% | Auto, total | 3 days + triage |
| CVE-2009-3459 | Acrobat and Reader | 2026-05-20 | 2026-06-03 | Unknown | 8.8 High | 86.5% | Not auto, total | 3 days + triage |
| CVE-2026-34621 | Acrobat and Reader | 2026-04-13 | 2026-04-27 | Unknown | 8.6 High | 7.2% | Not auto, total | 3 days + triage |
| CVE-2020-9715 | Acrobat | 2026-04-13 | 2026-04-27 | Unknown | 7.8 High | 33.2% | Not auto, total | 3 days + triage |
| CVE-2025-54236 | Commerce and Magento | 2025-10-24 | 2025-11-14 | Unknown | 9.1 Critical | 95.3% | Auto, total | 3 days + triage |
| CVE-2025-54253 | Experience Manager (AEM) Forms | 2025-10-15 | 2025-11-05 | Unknown | 10.0 Critical | 88.7% | Auto, total | 3 days + triage |
| CVE-2017-3066 | ColdFusion | 2025-02-24 | 2025-03-17 | Unknown | 9.8 Critical | 90.5% | Auto, total | 3 days + triage |
| CVE-2024-20767 | ColdFusion | 2024-12-16 | 2025-01-06 | Unknown | 7.4 High | 98.5% | Auto, partial | 3 days |
| CVE-2014-0502 | Flash Player | 2024-09-17 | 2024-10-08 | Unknown | 8.8 High | 24.8% | Auto, total | 3 days + triage |
| CVE-2014-0497 | Flash Player | 2024-09-17 | 2024-10-08 | Unknown | 9.8 Critical | 99.8% | Not auto, total | 3 days + triage |
| CVE-2013-0648 | Flash Player | 2024-09-17 | 2024-10-08 | Unknown | 8.8 High | 11.0% | Not auto, total | 3 days + triage |
| CVE-2013-0643 | Flash Player | 2024-09-17 | 2024-10-08 | Unknown | 8.8 High | 10.5% | Not auto, total | 3 days + triage |
| CVE-2024-34102 | Commerce and Magento Open Source | 2024-07-17 | 2024-08-07 | Unknown | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2023-38203 | ColdFusion | 2024-01-08 | 2024-01-29 | Known | 9.8 Critical | 97.0% | Auto, total | 3 days + triage |
| CVE-2023-29300 | ColdFusion | 2024-01-08 | 2024-01-29 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2023-21608 | Acrobat and Reader | 2023-10-10 | 2023-10-31 | Unknown | 7.8 High | 59.4% | Not auto, total | 3 days + triage |
| CVE-2023-26369 | Acrobat and Reader | 2023-09-14 | 2023-10-05 | Unknown | 7.8 High | 6.7% | Not auto, total | 3 days + triage |
| CVE-2023-26359 | ColdFusion | 2023-08-21 | 2023-09-11 | Unknown | 9.8 Critical | 16.9% | Auto, total | 3 days + triage |
| CVE-2023-38205 | ColdFusion | 2023-07-20 | 2023-08-10 | Unknown | 7.5 High | 99.7% | Auto, partial | 3 days |
| CVE-2023-29298 | ColdFusion | 2023-07-20 | 2023-08-10 | Unknown | 7.5 High | 99.7% | Auto, partial | 3 days |
| CVE-2023-26360 | ColdFusion | 2023-03-15 | 2023-04-05 | Unknown | 8.6 High | 97.3% | Auto, total | 3 days + triage |
| CVE-2018-4990 | Acrobat and Reader | 2022-06-08 | 2022-06-22 | Unknown | 8.8 High | 35.9% | Not auto, total | 3 days + triage |
| CVE-2012-5054 | Flash Player | 2022-06-08 | 2022-06-22 | Unknown | 8.8 High | 21.1% | Not auto, total | 3 days + triage |
| CVE-2012-0767 | Flash Player | 2022-06-08 | 2022-06-22 | Unknown | 6.1 Medium | 6.1% | Not auto, partial | 14 days |
| CVE-2012-0754 | Flash Player | 2022-06-08 | 2022-06-22 | Unknown | 8.1 High | 91.0% | Not auto, total | 3 days + triage |
| CVE-2011-2462 | Reader and Acrobat | 2022-06-08 | 2022-06-22 | Unknown | 9.8 Critical | 88.5% | Not auto, total | 3 days + triage |
| CVE-2011-0609 | Flash Player | 2022-06-08 | 2022-06-22 | Unknown | 7.8 High | 63.5% | Not auto, total | 3 days + triage |
| CVE-2010-2883 | Acrobat and Reader | 2022-06-08 | 2022-06-22 | Unknown | 7.3 High | 81.3% | Not auto, total | 3 days + triage |
| CVE-2010-1297 | Flash Player | 2022-06-08 | 2022-06-22 | Unknown | 7.8 High | 82.5% | Not auto, total | 3 days + triage |
| CVE-2009-4324 | Acrobat and Reader | 2022-06-08 | 2022-06-22 | Unknown | 7.8 High | 81.8% | Not auto, total | 3 days + triage |
| CVE-2009-3953 | Acrobat and Reader | 2022-06-08 | 2022-06-22 | Unknown | 8.8 High | 83.2% | Not auto, total | 3 days + triage |
| CVE-2009-1862 | Acrobat and Reader, Flash Player | 2022-06-08 | 2022-06-22 | Unknown | 7.8 High | 21.1% | Not auto, total | 3 days + triage |
| CVE-2008-0655 | Acrobat and Reader | 2022-06-08 | 2022-06-22 | Unknown | 8.8 High | 37.8% | Not auto, total | 3 days + triage |
| CVE-2007-5659 | Acrobat and Reader | 2022-06-08 | 2022-06-22 | Unknown | 7.8 High | 87.4% | Not auto, total | 3 days + triage |
| CVE-2016-1010 | Flash Player and AIR | 2022-05-25 | 2022-06-15 | Unknown | 8.8 High | 19.3% | Not auto, total | 3 days + triage |
| CVE-2016-0984 | Flash Player and AIR | 2022-05-25 | 2022-06-15 | Unknown | 8.8 High | 54.5% | Not auto, total | 3 days + triage |
| CVE-2015-8651 | Flash Player | 2022-05-25 | 2022-06-15 | Unknown | 8.8 High | 67.6% | Not auto, total | 3 days + triage |
| CVE-2015-0310 | Flash Player | 2022-05-25 | 2022-06-15 | Unknown | 7.8 High | 15.0% | Not auto, total | 3 days + triage |
| CVE-2014-8439 | Flash Player | 2022-05-25 | 2022-06-15 | Unknown | 8.8 High | 20.3% | Not auto, total | 3 days + triage |
| CVE-2014-0546 | Reader and Acrobat | 2022-05-25 | 2022-06-15 | Unknown | 9.8 Critical | 22.3% | Not auto, total | 3 days + triage |
| CVE-2018-5002 | Flash Player | 2022-05-23 | 2022-06-13 | Unknown | 7.8 High | 24.4% | Not auto, total | 3 days + triage |
| CVE-2015-5123 | Flash Player | 2022-04-13 | 2022-05-04 | Unknown | 9.8 Critical | 18.8% | Not auto, total | 3 days + triage |
| CVE-2015-5122 | Flash Player | 2022-04-13 | 2022-05-04 | Unknown | 9.8 Critical | 87.0% | Not auto, total | 3 days + triage |
| CVE-2015-3113 | Flash Player | 2022-04-13 | 2022-05-04 | Unknown | 9.8 Critical | 99.8% | Not auto, total | 3 days + triage |
| CVE-2015-0313 | Flash Player | 2022-04-13 | 2022-05-04 | Unknown | 9.8 Critical | 95.3% | Not auto, total | 3 days + triage |
| CVE-2015-0311 | Flash Player | 2022-04-13 | 2022-05-04 | Unknown | 9.8 Critical | 85.5% | Not auto, total | 3 days + triage |
| CVE-2014-9163 | Flash Player | 2022-04-13 | 2022-05-04 | Unknown | 7.8 High | 44.8% | Not auto, total | 3 days + triage |
| CVE-2013-2729 | Reader and Acrobat | 2022-03-28 | 2022-04-18 | Unknown | 9.8 Critical | 66.5% | Not auto, total | 3 days + triage |
| CVE-2012-2034 | Flash Player | 2022-03-28 | 2022-04-18 | Unknown | 7.5 High | 7.7% | Not auto, total | 3 days + triage |
| CVE-2016-7892 | Flash Player | 2022-03-25 | 2022-04-15 | Unknown | 8.8 High | 18.7% | Not auto, total | 3 days + triage |
| CVE-2016-4171 | Flash Player | 2022-03-25 | 2022-04-15 | Unknown | 9.8 Critical | 20.0% | Not auto, total | 3 days + triage |
| CVE-2010-2861 | ColdFusion | 2022-03-25 | 2022-04-15 | Known | 9.8 Critical | 99.7% | Auto, partial | 3 days |
| CVE-2009-0927 | Reader and Acrobat | 2022-03-25 | 2022-04-15 | Unknown | 8.8 High | 96.6% | Not auto, total | 3 days + triage |
| CVE-2013-0631 | ColdFusion | 2022-03-07 | 2022-09-07 | Unknown | 7.5 High | 66.4% | Auto, partial | 3 days |
| CVE-2013-0629 | ColdFusion | 2022-03-07 | 2022-09-07 | Unknown | 7.5 High | 65.7% | Auto, partial | 3 days |
| CVE-2013-0625 | ColdFusion | 2022-03-07 | 2022-09-07 | Unknown | 9.8 Critical | 93.7% | Auto, total | 3 days + triage |
| CVE-2009-3960 | BlazeDS | 2022-03-07 | 2022-09-07 | Known | 6.5 Medium | 90.1% | Not auto, partial | 14 days |
| CVE-2017-11292 | Flash Player | 2022-03-03 | 2022-03-24 | Unknown | 8.8 High | 11.8% | Not auto, total | 3 days + triage |
| CVE-2016-7855 | Flash Player | 2022-03-03 | 2022-03-24 | Unknown | 8.8 High | 25.1% | Not auto, total | 3 days + triage |
| CVE-2016-4117 | Flash Player | 2022-03-03 | 2022-03-24 | Known | 9.8 Critical | 94.2% | Not auto, total | 3 days + triage |
| CVE-2016-1019 | Flash Player | 2022-03-03 | 2022-03-24 | Known | 9.8 Critical | 22.3% | Not auto, total | 3 days + triage |
| CVE-2015-7645 | Flash Player | 2022-03-03 | 2022-03-24 | Known | 7.8 High | 65.3% | Not auto, total | 3 days + triage |
| CVE-2015-5119 | Flash Player | 2022-03-03 | 2022-03-24 | Unknown | 9.8 Critical | 98.6% | Not auto, total | 3 days + triage |
| CVE-2015-3043 | Flash Player | 2022-03-03 | 2022-03-24 | Unknown | 9.8 Critical | 73.8% | Not auto, total | 3 days + triage |
| CVE-2014-0496 | Reader and Acrobat | 2022-03-03 | 2022-03-24 | Unknown | 8.8 High | 39.9% | Not auto, total | 3 days + triage |
| CVE-2013-3346 | Reader and Acrobat | 2022-03-03 | 2022-03-24 | Unknown | 9.8 Critical | 78.9% | Not auto, total | 3 days + triage |
| CVE-2013-0641 | Reader | 2022-03-03 | 2022-03-24 | Unknown | 7.8 High | 32.3% | Not auto, total | 3 days + triage |
| CVE-2013-0640 | Reader and Acrobat | 2022-03-03 | 2022-03-24 | Unknown | 7.8 High | 86.9% | Not auto, total | 3 days + triage |
| CVE-2013-0632 | ColdFusion | 2022-03-03 | 2022-03-24 | Unknown | 9.8 Critical | 93.0% | Auto, total | 3 days + triage |
| CVE-2012-1535 | Flash Player | 2022-03-03 | 2022-03-24 | Unknown | 7.8 High | 70.3% | Not auto, total | 3 days + triage |
| CVE-2011-0611 | Flash Player | 2022-03-03 | 2022-03-24 | Unknown | 8.8 High | 99.4% | Not auto, total | 3 days + triage |
| CVE-2010-0188 | Reader and Acrobat | 2022-03-03 | 2022-03-24 | Known | 7.8 High | 88.2% | Not auto, total | 3 days + triage |
| CVE-2008-2992 | Acrobat and Reader | 2022-03-03 | 2022-03-24 | Known | 7.8 High | 99.7% | Not auto, total | 3 days + triage |
| CVE-2022-24086 | Commerce and Magento Open Source | 2022-02-15 | 2022-03-01 | Unknown | 9.8 Critical | 99.1% | Auto, total | 3 days + triage |
| CVE-2018-15982 | Flash Player | 2022-02-15 | 2022-08-15 | Known | 7.8 High | 89.5% | Not auto, total | 3 days + triage |
| CVE-2021-28550 | Acrobat and Reader | 2021-11-03 | 2021-11-17 | Unknown | 8.8 High | 52.1% | Not auto, total | 3 days + triage |
| CVE-2021-21017 | Acrobat and Reader | 2021-11-03 | 2021-11-17 | Unknown | 8.8 High | 86.3% | Not auto, total | 3 days + triage |
| CVE-2018-4939 | ColdFusion | 2021-11-03 | 2022-05-03 | Unknown | 9.8 Critical | 61.7% | Auto, total | 3 days + triage |
| CVE-2018-4878 | Flash Player | 2021-11-03 | 2022-05-03 | Known | 7.8 High | 90.2% | Not auto, total | 3 days + triage |
| CVE-2018-15961 | ColdFusion | 2021-11-03 | 2022-05-03 | Unknown | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
Due dates bind US federal civilian executive branch agencies only (BOD 26-04). Filter Adobe in the tracker by date, score or status.
Source: CISA Known Exploited Vulnerabilities Catalog; NVD, FIRST EPSS and CISA SSVC for the scores. This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA does not endorse Sysprobs.