Adobe Flash Player
CVE-2016-4117
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconVictim browses to compromised website
-
DeliveryMalicious SWF loads automatically
-
ExploitExploit triggers Flash Player vulnerability
-
InstallArbitrary code executes with browser privileges
-
C2Payload downloads and installs
-
ExecuteCommand and control established
-
ImpactImpact (data exfiltration, ransomware, lateral movement)
Vulnerability Assessment
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Adobe Flash Player versions 21.0.0.226 and earlier. Exploitation only requires that the victim has Flash Player installed and enabled in their web browser, which was the default state for most systems during the May 2016 exploitation window. The CVSS vector confirms AV:N (network vector), AC:L (low complexity), PR:N (no privileges required), and UI:N (no user interaction required), meaning simply browsing to a page hosting malicious Flash content triggers exploitation automatically. No special Flash Player features, non-default configurations, or specific deployment modes are required. The primary limiting factor is whether Flash Player is installed and enabled in the browser, though this was near-universal in enterprise and consumer environments during 2016, making the vulnerable population extremely large. |
| Impact | This represents an exceptionally high-severity threat with convergent risk signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-based exploitation with low complexity requiring no authentication or user interaction, earning the maximum 9.8 base score. CISA KEV listing confirms active exploitation in the wild during May 2016, meaning threat actors successfully weaponized this vulnerability before public disclosure. The 92.76% EPSS score at the 100th percentile represents near-certainty of exploitation attempts, validated by the historical reality of confirmed exploitation. Public exploit code availability (Exploit-DB 46339) lowers the barrier for adversaries. The attack vector requiring only that a victim browse to a malicious website or view attacker-controlled content makes this highly automatable for mass exploitation. The convergence of all risk indicators-maximum CVSS, confirmed exploitation, public POC, and extreme EPSS-makes this an unambiguous priority requiring immediate remediation. The only mitigating factor is the age of the vulnerability (2016), meaning most modern systems should have long since patched or removed Flash Player entirely, though legacy systems and isolated networks remain at risk if unpatched Flash installations persist. |
| Exploit ScenarioDerived | Attacker hosts malicious SWF content on compromised legitimate website or delivers via malvertising campaign targeting high-traffic web properties. Victim browses to attacker-controlled page using browser with vulnerable Flash Player plugin. Malicious SWF automatically executes without user interaction (no click required), triggers the vulnerability through crafted ActionScript or malformed Flash object, and achieves arbitrary code execution with browser process privileges. Attacker deploys second-stage payload for persistence, credential theft, or lateral movement across corporate networks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 21, 2026
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute arbitrary code without user interaction. Confirmed actively exploited (CISA KEV) in May 2016 with public exploit code available. EPSS score of 92.76% (100th percentile) reflects the extreme likelihood of exploitation. This was a critical zero-day vulnerability used in targeted attacks before Adobe released emergency patches in APSA16-02 and APSB16-15.
Earlier versions of this analysis (1)
An unspecified vulnerability in Adobe Flash Player enables remote code execution, actively exploited in May 2016 as a zero-day in targeted attack campaigns.
RemediationAI
Vendor-released patch: Adobe Flash Player 21.0.0.242 for Desktop Runtime, Extended Support Release 18.0.0.352, and corresponding versions for all browser plugins as documented in APSB16-15. Organizations should immediately upgrade to the patched versions using Adobe's distribution channels or enterprise update mechanisms. Red Hat Enterprise Linux users should apply RHSA-2016-1079 via yum/dnf package managers. OpenSUSE users should apply security updates from announcements SUSE-SU-2016:1305, 1306, 1307, and 1308. Given Flash Player's end-of-life status (December 2020), the strongest long-term mitigation is complete Flash Player removal from all systems, which eliminates entire attack surface with no operational trade-offs for modern web applications. For legacy systems requiring Flash for specific business applications, implement strict application whitelisting allowing only trusted SWF content, deploy browser isolation technologies to sandbox Flash execution, and block Flash content at network perimeter using web proxies or content filters configured to drop .swf files and Flash MIME types. Network segmentation should isolate any systems requiring legacy Flash from internet-facing networks. These compensating controls significantly reduce attack surface but introduce operational complexity and may break legitimate functionality requiring case-by-case business justification.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Flash Player is a deprecated multimedia runtime that executed ActionScript and rendered SWF content within web browsers and applications. The CPE data identifies the vulnerability affecting the Flash Player ActiveX control, NPAPI plugin, and Pepper API implementations across Windows, macOS, Linux, and ChromeOS platforms. Multiple CPE entries also indicate impacts to enterprise distributions including Red Hat Enterprise Linux 5/6 desktop, server, and workstation variants, plus OpenSUSE Evergreen 11.4, demonstrating the widespread deployment footprint. Without specific CWE classification, the root cause class remains unspecified in public data, though the 'unspecified vectors' language in the description combined with emergency patching suggests exploitation of a previously unknown code execution primitive in the Flash runtime, possibly related to ActionScript VM vulnerabilities, use-after-free conditions, or type confusion issues that were common in Flash Player vulnerabilities during this period.
Know when Flash Player gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
Executive ViewAI
CVE-2016-4117 is a critical remote code execution vulnerability in Adobe Flash Player affecting versions 21.0.0.226 and earlier, with confirmed active exploitation by threat actors as documented in CISA's Known Exploited Vulnerabilities catalog. This unauthenticated attack requires no user interaction, enabling attackers to achieve complete system compromise across any organization still running vulnerable Flash instances. Immediate identification and remediation of Flash installations is essential to prevent data breach and operational disruption.
If patching is delayed: (1) Disable Adobe Flash in all web browsers via Group Policy, browser settings, or endpoint management; (2) Block Flash content at network perimeter using web filtering and DLP; (3) Restrict network access to systems requiring Flash using zero-trust segmentation; (4) Deploy intrusion detection signatures for CVE-2016-4117 exploitation attempts; (5) Isolate or air-gap systems that cannot be patched or have Flash disabled. Note: This vulnerability is 8+ years old-continued presence of unpatched Flash represents critical risk posture failure. Prioritize complete Flash elimination over compensating controls.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
More in Flash Player
View allRemote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on L
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Window
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535