A newly discovered zero-day vulnerability in Adobe Flash Player is being exploited by attackers in the wild. Adobe released a Security Bulletin (APSB16-36) yesterday which patches the vulnerability (CVE-2016-7855).

The critical vulnerability affects Adobe Flash Player 23.0.0.185 and earlier versions for the following operating systems:

• Windows
• Mac
• Linux
• Chrome OS

According to Adobe, an exploit for the vulnerability exists in the wild and is being used in limited, targeted attacks against users running Windows versions 7, 8.1, and 10.

Mitigation advice

Flash Player users are advised to immediately update to the latest version. Since this vulnerability is already being exploited in the wild, users should make updating this software a priority.

Users who have yet to patch can temporarily disable Adobe Flash in the browser by taking the following steps:

Internet Explorer versions 10 and 11

1. Open Internet Explorer
2. Click on the Tools menu, and then click Manage add-ons
3. Under “Show”, select All add-ons
4. Select Shockwave Flash Object and then click on the Disable button

You can re-enable Adobe Flash by repeating the same process, selecting Shockwave Flash Object, and clicking on the Enable button.

Guidance for users of earlier versions of Internet Explorer is available on the Microsoft website; select the version of Internet Explorer you are using at the top right corner.

Firefox

1. Open Firefox
2. Open the browser menu and click Add-ons
3. Select the Plugins tab
4. Select Shockwave Flash and click Disable

You can re-enable Flash by repeating the same process, selecting Shockwave Flash, and clicking on the Enable button.

Chrome

1. Open Chrome
2. Enter chrome://plugins/ in the address bar and hit the Enter key
3. Click the Disable link under the Adobe Flash Player plugin

You can re-enable Flash by repeating the same process and clicking the Enable link.