CVE-2015-8409 is a critical access restriction bypass vulnerability affecting multiple versions of Adobe Flash Player, Adobe AIR, Adobe AIR SDK, and Adobe AIR SDK & Compiler across Windows, OS X, and Linux platforms. With a CVSS score of 10.0, this vulnerability allows unauthenticated remote attackers to completely compromise affected systems, leading to full confidentiality, integrity, and availability loss. While not listed on the KEV catalog, its high FAUCET Risk Score of 84/100 and community discussion indicate significant concern. There is no public exploit code available in Metasploit, Nuclei, or ExploitDB, but media coverage confirms it was addressed in a large patch update.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 19.0.0.241CPE matchmatch criteria | cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:* | ||
<= 19.0.0.241CPE matchmatch criteria | cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:* | ||
<= 18.0.0.261CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* | ||
19.0.0.185CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.185:*:*:*:*:*:*:* | ||
19.0.0.207CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.207:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.