Intel

CVE-2016-4117

Adobe Flash Player — Adobe Flash Player Arbitrary Code Execution Vulnerability

criticalRansomwareKEV: actively exploitedPoCEPSS 94%

Description

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

Source: CVELISTV5NVDCISA_KEVCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-4117 is a type-confusion vulnerability in Adobe Flash Player ≤ 21.0.0.226 enabling full remote code execution with no user interaction beyond visiting a malicious page or opening a crafted document. The EPSS score of 0.94 (99.8th percentile) reflects years of broad, documented exploitation across multiple attack campaigns. CISA's "Known Ransomware Campaign Use" flag confirms this vulnerability has been leveraged as an initial-access or lateral-movement step ahead of ransomware deployment. Because Flash is permanently end-of-life, no further patches exist — any organisation still running Flash carries permanent, unmitigable exposure unless Flash is fully removed. For NIS2-obligated entities (essential or important services), complete removal must be treated as a mandatory control; any residual Flash instances on OT/ICS systems should be formally documented as accepted risk and escalated to the CISO for sign-off.

Runbook · Step 1

Immediate response (0-24 h)

  • Uninstall or permanently disable Flash Player — Adobe Flash Player reached end-of-life on 31 December 2020; no further security patches will be issued. Removal is the only sustainable remediation. On Windows, use Control Panel → Programs → Adobe Flash Player or Adobe's official Flash Player Removal Tool.
  • Inventory all Flash installations — Query EDR or software inventory for remaining Flash components (NPAPI, PPAPI, ActiveX) across all endpoints; any version ≤ 21.0.0.226 is confirmed vulnerable.
  • Set ActiveX Kill-Bit (Windows) — Where immediate uninstallation is not feasible, apply the Kill-Bit for CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000} via GPO (Registry: HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}, DWORD Compatibility Flags = 0x00000400).
  • Enforce Click-to-Play or block Flash in browsers — Use Chrome Enterprise policy, Firefox ESR policy, or equivalent browser management to prevent Flash content from loading without explicit user approval — this effectively neutralises drive-by delivery.
  • Isolate systems that cannot be remediated immediately — Move legacy systems (SCADA HMI, OT consoles) still running Flash into isolated VLANs with no direct internet access; restrict outbound HTTP/HTTPS to an allowlist via a controlled forward proxy.

Runbook · Step 2

Mitigation layers

  • Network layer: Force all outbound connections from Flash-capable hosts through an authenticated forward proxy; block direct internet routing on ports 80/443 for these hosts.
  • IPS/WAF signature: Enable Suricata or Snort rules matching SWF file downloads — detect CWS or FWS magic bytes in HTTP response bodies combined with Content-Type: application/x-shockwave-flash. Example: alert tcp any any -> $HOME_NET any (msg:"Flash SWF Download"; content:"CWS"; depth:3; content:"application/x-shockwave-flash"; http_header; sid:9000001; rev:1;).
  • Endpoint hardening: Create AppLocker or WDAC rules blocking execution of Flash.ocx, NPSWF32*.dll, and pepflashplayer*.dll regardless of installation path.
  • Email gateway: Reject inbound attachments with .swf extensions and Office documents containing embedded Flash objects (OLE header D0 CF 11 E0 followed by Flash magic bytes) at the mail gateway.
  • Least privilege / IAM: Ensure browser processes run without local administrator rights; standard user accounts without local admin significantly reduce the blast radius of a successful RCE.

Runbook · Step 3

Detection rules

  • Sysmon EID 1 / EDR process ancestry: Flag cmd.exe or powershell.exe spawned as a child of iexplore.exe, firefox.exe, chrome.exe, or plugin-container.exe. Sigma shape: ParentImage|endswith: ['iexplore.exe','plugin-container.exe'] AND Image|endswith: ['cmd.exe','powershell.exe','wscript.exe'].
  • Windows Event ID 4688: Process creation for FlashPlayerPlugin*.exe or plugin-container.exe followed immediately by an outbound network connection (EID 5156 / Sysmon EID 3) to an external IP not in your asset inventory.
  • Proxy logs: HTTP responses with Content-Type: application/x-shockwave-flash or URI ending in .swf from external sources. KQL snippet: ProxyLog | where cs_mime_type == "application/x-shockwave-flash" or cs_uri_stem endswith ".swf" | summarize count() by ClientIP, ServerIP.
  • EDR memory anomaly: Cross-process injection originating from a Flash plugin process into an unrelated process such as svchost.exe — detectable via Sysmon EID 8 (CreateRemoteThread) where SourceImage matches a Flash plugin binary.
  • Auditd (Linux/macOS): execve syscall with parent process plugin-container or PepperFlashPlayer spawning unexpected children (/bin/sh, curl, wget). Auditd rule: -a always,exit -F arch=b64 -S execve -F ppid=$(pgrep plugin-container) -k flash_exec.

Metrics

Severity
critical
Priority score
208.90
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
99.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
94.3 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2016-05-11 01:59 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-10 04:17 UTC· psirt@adobe.com
    • Reference: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html
    • Reference: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html
    • Reference: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html
    • Reference: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html
  2. CVE Modified2026-09-10 04:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://github.com/cisagov/vulnrichment/issues/196
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4117
    • Reference: https://github.com/cisagov/vulnrichment/issues/196
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4117
  3. CVE Modified2026-09-10 04:17 UTC· af854a3a-2127-422b-91ae-364da2661108
    • Reference: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html
    • Reference: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html
    • Reference: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html
    • Reference: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html

Affected operating systems

  • linux

    redhat / enterprise_linux_desktop5.0

  • linux

    redhat / enterprise_linux_desktop6.0

  • linux

    redhat / enterprise_linux_server5.0

  • linux

    redhat / enterprise_linux_server6.0

  • linux

    redhat / enterprise_linux_server_from_rhui5.0

  • linux

    redhat / enterprise_linux_server_from_rhui6.0

  • linux

    redhat / enterprise_linux_workstation5.0

  • linux

    redhat / enterprise_linux_workstation6.0

  • linux

    opensuse / evergreen11.4

  • linux

    suse / linux_enterprise_desktop12

  • linux

    suse / linux_enterprise_workstation_extension12

  • linux

    opensuse / opensuse13.1

  • linux

    opensuse / opensuse13.2

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • adobe

    flash_player21.0.0.226

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-4117