CVE-2016-4117
critical CISA KEVAdobe Flash Player Arbitrary Code Execution Vulnerability
Vendor / product: Adobe — Flash Player
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2016-05-11 01:59
Modified: 2026-09-10 04:17
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Listed in CISA KEV
Added 2022-03-03 · due 2022-03-24
Known ransomware use: Known
Required action (CISA)
The impacted product is end-of-life and should be disconnected if still in use.
Affected products
adobe / flash_player ≤21.0.0.226
redhat / enterprise_linux_desktop 5.0, 6.0
redhat / enterprise_linux_server 5.0, 6.0
redhat / enterprise_linux_server_from_rhui 5.0, 6.0
redhat / enterprise_linux_workstation 5.0, 6.0
opensuse / evergreen 11.4
opensuse / opensuse 13.1, 13.2
suse / linux_enterprise_desktop 12
suse / linux_enterprise_workstation_extension 12
Weakness classification (CWE)
NVD-CWE-noinfo
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html psirt@adobe.com
- http://rhn.redhat.com/errata/RHSA-2016-1079.html psirt@adobe.com
- http://www.securityfocus.com/bid/90505 psirt@adobe.com
- http://www.securitytracker.com/id/1035826 psirt@adobe.com
- https://helpx.adobe.com/security/products/flash-player/apsa16-02.html psirt@adobe.com
- https://helpx.adobe.com/security/products/flash-player/apsb16-15.html psirt@adobe.com
- https://security.gentoo.org/glsa/201606-08 psirt@adobe.com
- https://www.exploit-db.com/exploits/46339/ psirt@adobe.com
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html af854a3a-2127-422b-91ae-364da2661108
- http://rhn.redhat.com/errata/RHSA-2016-1079.html af854a3a-2127-422b-91ae-364da2661108
- http://www.securityfocus.com/bid/90505 af854a3a-2127-422b-91ae-364da2661108
- http://www.securitytracker.com/id/1035826 af854a3a-2127-422b-91ae-364da2661108
- https://helpx.adobe.com/security/products/flash-player/apsa16-02.html af854a3a-2127-422b-91ae-364da2661108
- https://helpx.adobe.com/security/products/flash-player/apsb16-15.html af854a3a-2127-422b-91ae-364da2661108
- https://security.gentoo.org/glsa/201606-08 af854a3a-2127-422b-91ae-364da2661108
- https://www.exploit-db.com/exploits/46339/ af854a3a-2127-422b-91ae-364da2661108
- https://github.com/cisagov/vulnrichment/issues/196 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4117 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
CISA KEV — fetched 2026-10-27 06:50 UTC · record ↗
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗