CVE-2016-4117

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

First PoC 2019-02-11
2502 days →Metasploit 2025-12-17
304 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2022-03-03 · due 2022-03-24 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 94%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

2 known · links only

Metasploit1

Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion ↗
This module exploits a type confusion on Adobe Flash Player, which was originally found being successfully exploited in the wild. This module has been tested successfully on: macOS Sierra 10.12.3, Safari and Adobe Flash Player 21.0.0.182, Firefox and Adobe Flash Player 21.0.0.182.
ruby · seen 2026-10-18

Exploit-DB1

Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit) ↗
created 2019-02-11

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

APT28
1. “CVE-2016-4117: Adobe Flash Player Remoted Attack Vulnerability”
  cited as exploiting · named nearby · source: us-cert.gov ↗ · 2026-10-17
NEODYMIUM
1. “NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used, prior to public knowledge of the vulnerability’s existence.”
  cited as exploiting · source: download.microsoft.com ↗ · 2026-10-17
2. “In early May 2016, both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe. They both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that, at the time, was both unknown and unpatched.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
3. “In early May 2016, both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe. They both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that, at the time, was both unknown and unpatched.”
  cited as exploiting · source: blogs.technet.microsoft.com ↗ · 2026-10-17
PROMETHIUM
1. “In early May 2016, both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe. They both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that, at the time, was both unknown and unpatched.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
2. “In early May 2016, both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe. They both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that, at the time, was both unknown and unpatched.”
  cited as exploiting · source: blogs.technet.microsoft.com ↗ · 2026-10-17
3. “In 2016, an attack campaign by this group was recorded in early May that made use of an exploit for CVE-2016-4117, a vulnerability in Adobe Flash Player, which at the time was both unknown and unpatched.”
  cited as exploiting · named nearby · source: download.microsoft.com ↗ · 2026-10-17
APT37
1. “APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
BlackOasis
1. “We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.”
  cited as exploiting · source: securelist.com ↗ · 2026-10-17
2. “Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of “FinSpy” malware, according to a new blog post published Monday.”
  cited as exploiting · named nearby · source: cyberscoop.com ↗ · 2026-10-17
3. “CVE-2016-4117 – May 2016”
  cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals

Exploits

Metasploit1

Exploit-DB1

On the wire

Watch this one?