Skip to content
Weekly Signal
Live intelligence Updated 19 Aug 2026 · 13:41 UTC

Adobe, Opensuse, Redhat +1 more · Flash Player, Evergreen, Opensuse +6 more

CVE-2016-4117

Adobe Flash Player Arbitrary Code Execution Vulnerability

Recommended action

Validate affected assets and exposure now, then remediate on an accelerated schedule. The impacted product is end-of-life and should be disconnected if still in use.

View response plan
CVSS9.8
EPSS94.4%
KEVYes
ExploitationConfirmed exploitation
PatchPatch or guidance available ↓

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 94.4%; technical severity is CVSS 9.8.

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

Who should care

  • Teams operating Flash Player, Evergreen, Opensuse +6 more
  • Vulnerability and exposure management teams
  • Security operations teams monitoring exploitation activity

Response plan

What I would do

  1. Confirm whether Flash Player, Evergreen, Opensuse +6 more is present in the environment.
  2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
  3. The impacted product is end-of-life and should be disconnected if still in use.
  4. Review relevant security telemetry for evidence of attempted or successful exploitation.
  5. Document the remediation decision and track it to verified completion.

Vendor remediation

Patch and remediation links

Use the vendor source below to confirm the correct fixed version, package or mitigation for your affected product.

Technical details

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not classified
Affected versions
Adobe Flash Player (End Including: 21.0.0.226); Opensuse Evergreen (Version: 11.4); Opensuse Opensuse (Version: 13.2); Redhat Enterprise Linux Desktop (Version: 6.0); Redhat Enterprise Linux Server (Version: 6.0); Redhat Enterprise Linux Server From Rhui (Version: 6.0); Redhat Enterprise Linux Workstation (Version: 6.0); Suse Linux Enterprise Desktop (Version: 12)
Published
10 May 2016
Attack vector
Network
Privileges required
None
User interaction
None

Signal timeline

  1. CVE published
  2. Added to CISA KEV
  3. Latest EPSS score: 94.4%
  4. Signal calculated at 84

External references

Live public intelligence This assessment combines public-source evidence. Validate the affected product, version and exposure against your own environment before making a risk decision.