Microsoft Security
Mentions the CVE; no further detail.
3 passages name itOriginal (opens in a new tab) ↗
CVE-2015-0311 KEVPublic exploit Critical · 9.8 EPSS 85.6%
Adobe Flash Player Remote Code Execution Vulnerability
Adobe · Flash Player
Summary
Adobe Flash Player contains an unspecified flaw in its handling of content, affecting versions through 13.0.0.262, the 14.x, 15.x and 16.x lines through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux. A remote attacker with no privileges and no required user interaction can execute arbitrary code by using unknown vectors, with the attack carried out over the network.
Official description · NVD
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
85.9 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 2
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 days before it was disclosed. Public exploit code (Metasploit) was available 9 months before disclosure.
- Public exploit codeMetasploit9 mo before
- First seen exploitedVulnCheck KEV evidence3 days before
- Disclosedday 0
- Added to CISA KEVEU database agrees+7 yrs
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 2 available links are lower confidence and listed below.
Lower-confidence links (2)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Drive-by CompromiseT1189 server-side bug exploitable without user interaction; client-execution technique does not fit
- Exploitation for Client ExecutionT1203 server-side bug exploitable without user interaction; client-execution technique does not fit
What security researchers reported
Named in 2 threat reports2 reportsMicrosoft2
Reports are matched by finding the exact id CVE-2015-0311 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Microsoft Security
Mentions the CVE; no further detail.
3 passages name itOriginal (opens in a new tab) ↗
Also mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX