Adobe

CPE vendor key: adobe · 2,102 CVEs published in the last 24 months.

CVEs (365 d)

1,203

▼ -41 vs prior 30d

Avg CVSS (365 d)

6.87

over 1,203 CVEs

Avg EPSS pct (365 d)

0.28

higher = more likely exploited

KEV hit rate (365 d)

0.3%

4 of 1,203 added to CISA KEV

LLM-credited CVEs

none detected

Monthly CVE volume — last 24 months

Each point is one calendar month. Bars in the severity card to the right slice the same volume by CVSS band.

Severity mix

Stacked by CVSS band (Critical / High / Medium / Low) using the best available metric per CVE.

Top affected products (24 mo)

experience_manager

683

coldfusion

145

commerce_b2b

119

magento

110

commerce

110

acrobat

102

acrobat_dc

acrobat_reader_dc

indesign

c2pa

Distinct CVEs that include each product in their CPE configuration.

Top CWEs (24 mo)

768

295

178

126

Distinct CVEs assigned each weakness.

Recent CISA KEV adds (last 12 months)

Added	CVE	Product	KEV name
2026-09-24	CVE-2026-71362	Commerce and Magento	Adobe Commerce and Magento Incorrect Authorization Vulnerability
2026-09-08	CVE-2026-75650	Commerce and Magento	Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
2026-07-07	CVE-2026-48282	ColdFusion	Adobe ColdFusion Path Traversal Vulnerability
2026-05-20	CVE-2009-3459	Acrobat and Reader	Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
2026-04-13	CVE-2026-34621	Acrobat and Reader	Adobe Acrobat and Reader Prototype Pollution Vulnerability
2026-04-13	CVE-2020-9715	Acrobat	Adobe Acrobat Use-After-Free Vulnerability

Filtered to KEV entries whose CISA vendor or product name matches this vendor exactly, to drop cross-OS noise (e.g. third-party Windows apps that CPE-map to Microsoft).

Known exploited, all time (82)

Published	CVE
2026-09-07	CVE-2026-75650
2026-08-11	CVE-2026-71362
2026-06-30	CVE-2026-48282
2026-04-11	CVE-2026-34621
2025-09-09	CVE-2025-54236
2025-08-05	CVE-2025-54253
2024-06-13	CVE-2024-34102
2024-03-18	CVE-2024-20767
2023-09-14	CVE-2023-38205
2023-09-13	CVE-2023-26369
2023-07-20	CVE-2023-38203
2023-07-12	CVE-2023-29298
2023-07-12	CVE-2023-29300
2023-03-23	CVE-2023-26359
2023-03-23	CVE-2023-26360
2023-01-18	CVE-2023-21608
2022-02-16	CVE-2022-24086
2021-09-02	CVE-2021-28550
2021-02-11	CVE-2021-21017
2020-08-19	CVE-2020-9715
2019-01-18	CVE-2018-15982
2018-09-25	CVE-2018-15961
2018-07-09	CVE-2018-4990
2018-07-09	CVE-2018-5002
2018-05-19	CVE-2018-4939
2018-02-06	CVE-2018-4878
2017-10-22	CVE-2017-11292
2017-04-27	CVE-2017-3066
2016-12-15	CVE-2016-7892
2016-11-01	CVE-2016-7855
2016-06-16	CVE-2016-4171
2016-05-11	CVE-2016-4117
2016-04-07	CVE-2016-1019
2016-03-12	CVE-2016-1010
2016-02-10	CVE-2016-0984
2015-12-28	CVE-2015-8651
2015-10-15	CVE-2015-7645
2015-07-14	CVE-2015-5122
2015-07-14	CVE-2015-5123
2015-07-08	CVE-2015-5119
2015-06-23	CVE-2015-3113
2015-04-14	CVE-2015-3043
2015-02-02	CVE-2015-0313
2015-01-23	CVE-2015-0310
2015-01-23	CVE-2015-0311
2014-12-10	CVE-2014-9163
2014-11-25	CVE-2014-8439
2014-08-12	CVE-2014-0546
2014-02-21	CVE-2014-0502
2014-02-05	CVE-2014-0497
2014-01-15	CVE-2014-0496
2013-08-30	CVE-2013-3346
2013-05-16	CVE-2013-2729
2013-02-27	CVE-2013-0643
2013-02-27	CVE-2013-0648
2013-02-14	CVE-2013-0640
2013-02-14	CVE-2013-0641
2013-01-17	CVE-2013-0632
2013-01-09	CVE-2013-0625
2013-01-09	CVE-2013-0629

Attributed by CPE rather than by CISA's vendor name, so it includes CVEs filed under another vendor whose affected-product list names this one — shared library code is the usual reason. Broader, and noisier, than the name-matched card above on purpose.

Generated 25 October 2026 00:36 UTC .