Adobe · Acrobat
CVE-2020-9715
Adobe Acrobat Use-After-Free Vulnerability
What it is
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
CISA: Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: April 27, 2026
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 27, 2026 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | Critical 9.3 | 31% |
| Sep 24, 2026 | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | Critical 9.1 | 90% |
| Sep 8, 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | Critical 10.0 | 3.9% |
| Jul 7, 2026 | Path Traversal | ColdFusion | Critical 10.0 | 42% |
| May 20, 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | High 8.8 | 87% |
| Apr 13, 2026 | Prototype Pollution | Acrobat and Reader | High 8.6 | 7.2% |
| Oct 24, 2025 | Improper Input Validation | Commerce and Magento | Critical 9.1 | 95% |
| Oct 15, 2025 | Experience Manager Forms Code Execution | Experience Manager (AEM) Forms | Critical 10.0 | 89% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.