Intel

CVE-2016-1019

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute ar… (CVE-2016-1019)

criticalRansomwareKEV: actively exploitedPoCEPSS 22%

Description

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

Source: CVELISTV5CISA_KEVNVDCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-1019 carries a CVSS v3 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and sits at the 97.5th EPSS percentile, reflecting near-certain exploitation probability across exposed environments. CISA has flagged confirmed ransomware campaign use, making this directly relevant to NIS2 Article 23 incident-reporting obligations for KRITIS organisations. Because Adobe Flash is permanently end-of-life with no further patches, the risk cannot be remediated — only eliminated by removal; any remaining Flash installation represents an unmitigable attack surface. Prioritise internet-facing workstations, kiosk terminals, and SCADA HMIs with embedded browsers as the highest-risk asset classes.

Runbook · Step 1

Immediate response (0-24 h)

  • Remove Flash entirely — Adobe Flash Player has been End-of-Life since 31 December 2020; no patch exists for current systems. Uninstall all versions ≤ 21.0.0.197 (Desktop Runtime, NPAPI, PPAPI, ActiveX) immediately via Group Policy or software distribution tooling.
  • Disable browser plugins — Enforce DisableFlashInIE via GPO (HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Security) and disable Flash plugins in Chrome, Firefox, and Edge through Managed Preferences if not already done.
  • Remove Adobe AIR — Adobe AIR Desktop Runtime ≤ 21.0.0.176 and AIR SDK ≤ 21.0.0.176 share the vulnerable codebase and must also be uninstalled.
  • Block SWF content at the network perimeter — Configure your web proxy/gateway to block MIME types application/x-shockwave-flash and application/futuresplash, and file extensions .swf and .spl.
  • Run an asset inventory sweep — Within two hours, use SCCM inventory, Qualys, or equivalent tooling to identify any remaining Flash installations and prioritise them for immediate removal.

Runbook · Step 2

Mitigation layers

  • Network segmentation — Isolate systems where Flash cannot be removed immediately (e.g. legacy OT/HMI terminals) in a restricted VLAN with no outbound internet access; block TCP 80/443 to external hosts from that segment.
  • WAF/proxy rule — Add a content-inspection rule to your web proxy ACL targeting Content-Type: application/x-shockwave-flash. Suricata rule shape: alert http any any -> any any (msg:"SWF delivery blocked"; content:"application/x-shockwave-flash"; http_header; sid:9001619;).
  • AppLocker / Software Restriction Policies — Deny execution of Flash*.exe, FlashUtil*.exe, and Flash-related plugin-container.exe via AppLocker publisher rules (Adobe Systems, product name Flash Player).
  • Email gateway — Block attachments with extensions .swf and .fla at the mail gateway; exploit kits historically delivered Flash payloads via malvertising and phishing attachments.
  • Least privilege / browser sandboxing — Ensure browser processes do not run with elevated privileges; enable Internet Explorer Protected Mode to limit post-exploitation lateral movement.

Runbook · Step 3

Detection rules

  • Process anomaly (Sysmon EID 1) — Child processes of iexplore.exe, chrome.exe, firefox.exe, or plugin-container.exe spawning cmd.exe, powershell.exe, or wscript.exe: Sigma shape ParentImage|endswith: '\plugin-container.exe' AND Image|endswith: '\cmd.exe'.
  • File write event (Sysmon EID 11) — Flash plugin writing executables to %TEMP% or %APPDATA%: Image|contains: 'Flash' AND TargetFilename|endswith: '.exe'.
  • Network telemetry (Zeek/Suricata) — HTTP responses with Content-Type: application/x-shockwave-flash from non-whitelisted domains. KQL for Defender/Sentinel: DeviceNetworkEvents | where RemoteUrl contains ".swf" | summarize count() by DeviceName, RemoteUrl.
  • Windows Event Log (EID 4688) — Process creation where a browser is the parent and the child is mshta.exe, regsvr32.exe, or rundll32.exe with no expected arguments — a classic shellcode-staging pattern.
  • EDR telemetry — Alert on any active loading of FlashPlayerPlugin_*.exe or NPSWF*.dll after 31 December 2020; any activity from these components on a current system is an anomaly indicator regardless of exploit context.

Metrics

Severity
critical
Priority score
207.49
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
97.6 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
22.5 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2016-04-07 10:00 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • adobe

    air_desktop_runtime21.0.0.176

  • adobe

    air_sdk21.0.0.176

  • adobe

    air_sdk_\&_compiler21.0.0.176

  • adobe

    flash_player11.2.202.577

  • adobe

    flash_player18.0.0.333

  • adobe

    flash_player21.0.0.197

  • adobe

    flash_player_desktop_runtime21.0.0.197

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-1019