CVE-2016-1019: Adobe Flash Player Arbitrary Code Execution Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 3 Mar 2022, 2,156 days after the CVE record was published.

How likely is exploitation in the next 30 days?

22.3%

EPSS score, percentile 97.7 of all scored records

How severe?

7.8 High

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

CISA deadline 24 Mar 2022. The impacted product is end-of-life and should be disconnected if still in use.

Advisories and patches (9)

Which versions are affected?

Not stated. The CVE record gives vendor and product as “n/a” and the version as “unspecified”.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

CISA due date for this action: 24 March 2022.

Advisories and patches

• GLSA-201606-08 (Vendor advisory)
• openSUSE-SU-2016:0997 (Vendor advisory)
• SUSE-SU-2016:0990 (Vendor advisory)
• SUSE-SU-2016:1305 (Vendor advisory)
• openSUSE-SU-2016:0987 (Vendor advisory)
• openSUSE-SU-2016:1306 (Vendor advisory)
• openSUSE-SU-2016:1157 (Vendor advisory)
• RHSA-2016:0610 (Vendor advisory)
• MS16-050 (Vendor advisory)

Linked from CISA's catalog entry

• https://nvd.nist.gov/vuln/detail/CVE-2016-1019

Affected products and versions

The CVE record does not name affected products or versions: vendor and product are “n/a” and the version is “unspecified”.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

• CISA added CVE-2016-1019 to its Known Exploited Vulnerabilities (KEV) catalog on 3 Mar 2022.
• CISA marks it as known to be used in ransomware campaigns.
• The due date CISA sets for the required action is 24 Mar 2022.
• The CVE record was published on 7 Apr 2016, 2,156 days before it was added to KEV.
• The CVE record carries a CVSS v3.1 base score of 7.8 (High), taken from CISA's enrichment of the record.
• FIRST's EPSS model puts the probability of exploitation in the next 30 days at 22.3% (percentile 97.7), as of 28 Oct 2026.
• CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Timeline

References

• 1035491 (Vulnerability database)
• 85856 (Vulnerability database)
• fireeye.com

3 more in the CVE record.

More exploited Adobe vulnerabilities

• CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (added 27 Oct 2026)
• CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability (added 24 Sep 2026)
• CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (added 8 Sep 2026)
• CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability (added 7 Jul 2026)
• CVE-2009-3459: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability (added 20 May 2026)
• CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability (added 13 Apr 2026)