CVE-2017-11292

Adobe Flash Player's unpatched type confusion vulnerability allowed remote code execution, proving that end-of-life software remains a perpetual security liability.

Adobe Flash Player, discontinued in December 2020, contained a type confusion vulnerability enabling remote code execution. Because the product reached end-of-life with no further security updates, any remaining installations are perpetually vulnerable to unpatched exploits. DIB organizations must ensure all legacy software is fully retired to avoid exposure to actively exploited vulnerabilities.

Shame score — The vendor discontinued the product without ensuring a safe transition, leaving organizations with a perpetual security liability that was actively exploited in the wild.