Is CVE-2016-4171 being actively exploited?

Yes. CVE-2016-4171 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on March 25, 2022.

What is the CVSS score for CVE-2016-4171?

CVE-2016-4171 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2016-4171

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 20.1%EU EUVD: exploited

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS score: 20.1% (97th percentile)
In CISA KEV: Yes, added March 25, 2022
In EU EUVD: Yes (EUVD-2016-5172)
Published: June 16, 2016
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Adobe Flash Player Remote Code Execution Vulnerability

Added to the KEV catalog on March 25, 2022; federal remediation due April 15, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2016-5172 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on November 17, 2025.

View on the EU Vulnerability Database

Affected products

adobe / flash player
adobe / flash player
adobe / flash player
adobe / flash player
adobe / flash player
apple / mac os x
apple / macos
google / chrome os
linux / linux kernel
linux / linux kernel
microsoft / windows
microsoft / windows 10
microsoft / windows 8.1
opensuse / opensuse
opensuse / opensuse
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux workstation
redhat / enterprise linux workstation
suse / linux enterprise desktop
suse / linux enterprise desktop
suse / linux enterprise workstation extension
suse / linux enterprise workstation extension

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 5 OpenSSH-Server Cryptographic Module - Red Hat®, Inc. - FIPS 140 1384 - historical

References

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html(Mailing List, Third Party Advisory)
http://www.securityfocus.com/bid/91184(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1036094(Third Party Advisory, VDB Entry)
https://access.redhat.com/errata/RHSA-2016:1238(Third Party Advisory)
https://github.com/cisagov/vulnrichment/issues/196(Issue Tracking)
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html(Vendor Advisory)
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html(Vendor Advisory)
https://security.gentoo.org/glsa/201606-08(Third Party Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4171(US Government Resource)
https://www.kb.cert.org/vuls/id/748992(Third Party Advisory, US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain