CVE-2016-4117: Adobe Flash Player unspecified vectors allow arbitrary code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8, confirmed in-the-wild exploitation, KEV listing with ransomware use, and a 99.8th percentile EPSS score make this an urgent risk on any system still running Flash.

What it is

Adobe Flash Player 21.0.0.226 and earlier contains a critical flaw that lets remote attackers execute arbitrary code through unspecified vectors. Adobe confirmed the issue was exploited in the wild in May 2016, and the product is now end-of-life. The lack of technical detail in the record means the exact root cause is not described.

Impact

A successful attack gives the attacker arbitrary code execution in the context of the Flash Player process, which can lead to full system compromise. CISA's KEV entry notes known ransomware campaign use, so impact can extend to data encryption and extortion.

Attack surface

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network with no authentication and no user interaction required. In practice Flash content is typically delivered through a browser or document, but the record does not specify the exact delivery vector.

Exploitation

CISA added this CVE to the KEV catalog on 2022-03-03 with a due date of 2022-03-24 and flags known ransomware campaign use. EPSS gives a 30-day exploitation probability of 0.94354 (99.846th percentile), and a public Exploit-DB entry exists.

What to do

• Remove or disable Adobe Flash Player; it is end-of-life and CISA's required action is to disconnect the product if still in use.
• If Flash cannot be removed immediately, apply the final Adobe security update and any vendor patches (Red Hat RHSA-2016-1079, openSUSE, SUSE, Gentoo GLSA 201606-08) and block Flash content at the browser and email gateway.
• Enforce browser settings and enterprise policy that prevent automatic Flash execution and restrict untrusted SWF content.
• Segment and monitor any remaining systems that still run Flash, and treat them as high-risk until decommissioned.

Detection

• Hunt for flash player processes (flashplayer, npapi/ppapi plugin hosts) spawning child processes such as cmd.exe, powershell.exe, or /bin/sh.
• Monitor for SWF file downloads and execution from email attachments, web downloads, or temporary directories.
• Review endpoint and network logs for known Flash exploit delivery patterns and for the public Exploit-DB proof-of-concept behavior.
• Alert on any host still reporting Flash Player version 21.0.0.226 or earlier.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.