Vendor History
Email, files and business apps
Adobe security incident history
Updated . Data gathered daily from official public sources.
As of Oct 26, 2026, Vendor History found 1 state breach notice and 82 actively exploited security flaws for Adobe, dated Oct 3, 2013 to Sep 24, 2026. The most recent breach notice or SEC filing was on Oct 3, 2013. Sources checked: the California and Washington Attorney General breach lists, SEC EDGAR (Form 8-K, Item 1.05) and CISA's Known Exploited Vulnerabilities catalog.
Breach notices and SEC cyber filings
-
Adobe Systems Incorporated filed a data breach notice with the California Attorney General. Breach date(s) listed: 09/11/2013, 09/12/2013, 09/13/2013, 09/14/2013, 09/15/2013, 09/16/2013, 09/17/2013.
Source: California Attorney General
Got a breach letter from Adobe? What to do when a vendor has a data breach.
Actively exploited security flaws
Flaws in Adobe products that CISA lists as exploited by attackers. If you use an affected product, check that it's updated. What a listing means.
-
Adobe Commerce and Magento Incorrect Authorization Vulnerability (CVE-2026-71362). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CVE-2026-75650). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-48282). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability (CVE-2009-3459). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat Use-After-Free Vulnerability (CVE-2020-9715). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Prototype Pollution Vulnerability (CVE-2026-34621). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Commerce and Magento Improper Input Validation Vulnerability (CVE-2025-54236). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Experience Manager Forms Code Execution Vulnerability (CVE-2025-54253). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Deserialization Vulnerability (CVE-2017-3066). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Improper Access Control Vulnerability (CVE-2024-20767). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Incorrect Default Permissions Vulnerability (CVE-2013-0643). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Code Execution Vulnerability (CVE-2013-0648). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Integer Underflow Vulnerablity (CVE-2014-0497). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Double Free Vulnerablity (CVE-2014-0502). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability (CVE-2024-34102). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2023-29300). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2023-38203). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe Acrobat and Reader Use-After-Free Vulnerability (CVE-2023-21608). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability (CVE-2023-26369). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2023-26359). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Improper Access Control Vulnerability (CVE-2023-29298). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Improper Access Control Vulnerability (CVE-2023-38205). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2023-26360). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Buffer Overflow Vulnerability (CVE-2007-5659). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Unspecified Vulnerability (CVE-2008-0655). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability (CVE-2009-1862). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability (CVE-2009-3953). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Use-After-Free Vulnerability (CVE-2009-4324). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Memory Corruption Vulnerability (CVE-2010-1297). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability (CVE-2010-2883). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Unspecified Vulnerability (CVE-2011-0609). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability (CVE-2011-2462). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Memory Corruption Vulnerability (CVE-2012-0754). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability (CVE-2012-0767). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Integer Overflow Vulnerability (CVE-2012-5054). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Double Free Vulnerability (CVE-2018-4990). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Reader and Acrobat Sandbox Bypass Vulnerability (CVE-2014-0546). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Dereferenced Pointer Vulnerability (CVE-2014-8439). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player ASLR Bypass Vulnerability (CVE-2015-0310). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Integer Overflow Vulnerability (CVE-2015-8651). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player and AIR Use-After-Free Vulnerability (CVE-2016-0984). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player and AIR Integer Overflow Vulnerability (CVE-2016-1010). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Stack-based Buffer Overflow Vulnerability (CVE-2018-5002). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Stack-Based Buffer Overflow Vulnerability (CVE-2014-9163). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Remote Code Execution Vulnerability (CVE-2015-0311). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Use-After-Free Vulnerability (CVE-2015-0313). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability (CVE-2015-3113). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Use-After-Free Vulnerability (CVE-2015-5122). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Use-After-Free Vulnerability (CVE-2015-5123). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Memory Corruption Vulnerability (CVE-2012-2034). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability (CVE-2013-2729). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability (CVE-2009-0927). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Directory Traversal Vulnerability (CVE-2010-2861). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe Flash Player Remote Code Execution Vulnerability (CVE-2016-4171). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Use-After-Free Vulnerability (CVE-2016-7892). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe BlazeDS Information Disclosure Vulnerability (CVE-2009-3960). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe ColdFusion Authentication Bypass Vulnerability (CVE-2013-0625). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Directory Traversal Vulnerability (CVE-2013-0629). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Information Disclosure Vulnerability (CVE-2013-0631). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Reader and Acrobat Input Validation Vulnerability (CVE-2008-2992). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability (CVE-2010-0188). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe Flash Player Remote Code Execution Vulnerability (CVE-2011-0611). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Arbitrary Code Execution Vulnerability (CVE-2012-1535). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Authentication Bypass Vulnerability (CVE-2013-0632). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Reader and Acrobat Memory Corruption Vulnerability (CVE-2013-0640). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Reader Buffer Overflow Vulnerability (CVE-2013-0641). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Reader and Acrobat Memory Corruption Vulnerability (CVE-2013-3346). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Reader and Acrobat Use-After-Free Vulnerability (CVE-2014-0496). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Memory Corruption Vulnerability (CVE-2015-3043). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Use-After-Free Vulnerability (CVE-2015-5119). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Arbitrary Code Execution Vulnerability (CVE-2015-7645). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe Flash Player Arbitrary Code Execution Vulnerability (CVE-2016-1019). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe Flash Player Arbitrary Code Execution Vulnerability (CVE-2016-4117). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe Flash Player Use-After-Free Vulnerability (CVE-2016-7855). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Type Confusion Vulnerability (CVE-2017-11292). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Use-After-Free Vulnerability (CVE-2018-15982). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability (CVE-2022-24086). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe ColdFusion Unrestricted File Upload Vulnerability (CVE-2018-15961). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Flash Player Use-After-Free Vulnerability (CVE-2018-4878). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability (CVE-2018-4939). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability (CVE-2021-21017). Added to CISA's list of security flaws known to be exploited by attackers.
-
Adobe Acrobat and Reader Use-After-Free Vulnerability (CVE-2021-28550). Added to CISA's list of security flaws known to be exploited by attackers.
We check: California and Washington Attorney General breach notices, SEC cyber incident filings (Form 8-K, Item 1.05) and CISA's catalog of actively exploited security flaws. An empty section means we found nothing in those sources. It does not mean nothing happened. How it works
To cite: Vendor History, "Adobe security incident history," vendorhistory.com/vendor/adobe, data checked Oct 26, 2026. Free to reuse under CC BY 4.0 with credit to Vendor History.