CVE-2016-4117
KEVRansomware UseAdobe Flash Player Arbitrary Code Execution Vulnerability
Description
An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedMay 11, 2016
Last modifiedSep 10, 2026
Added to KEVMar 3, 2022
Remediation dueMar 24, 2022
References
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.htmlMailing ListThird Party Advisory
- rhn.redhat.com/errata/RHSA-2016-1079.htmlThird Party Advisory
- securityfocus.com/bid/90505Broken LinkThird Party Advisory
- securitytracker.com/id/1035826Broken LinkThird Party Advisory
- helpx.adobe.com/security/products/flash-player/apsa16-02.htmlBroken LinkVendor Advisory
- helpx.adobe.com/security/products/flash-player/apsb16-15.htmlBroken Link
- security.gentoo.org/glsa/201606-08Third Party Advisory
- exploit-db.com/exploits/46339/ExploitThird Party Advisory
- github.com/cisagov/vulnrichment/issues/196Issue Tracking
0 recent articles mention this CVE
98
Risk assessment · Critical
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1678 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 94.4% · top 1% of all CVEs
- Weakness
- NVD-CWE-noinfo
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.The impacted product is end-of-life and should be disconnected if still in use.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.