Discovered being exploited in the wild by FireEye  on May 8, 2016, patched 4 days later with Flash 18.104.22.168, CVE-2016-4117 is making its way to Exploit Kits.
CVE confirmed by FireEye - Thanks !
On 2016-05-21 Magnitude is firing an exploit to Flash up to 22.214.171.124.
|Magnitude firing exploit to Flash 126.96.36.199 - 2016-05-21|
|Magnitude Flash Exploit showing import of the DeleteRangeTimelineOperation|
Spotted sample : f5cea58952ff30e9bd2a935f5843d15952b4cf85cdd1ad5d01c8de2000c48b0a
Fiddler sent here.Updates to come as it appears to be a work in progress.
Spotted by Eset.
|2016-05-23 Neutrino successfully exploit CVE-2016-4117 on Flash 188.8.131.52 and drop here CryptXXX|
Fiddler sent here (Password is malware)
Out of topic payload: 110891e2b7b992e238d4afbaa31e165a6e9c25de2aed442574d3993734fb5220 CryptXXX
CVE identification by Henri Nurmi from F-Secure. Thanks !
|Angler EK successfully exploit Flash 184.108.40.206 on 2016-05-23 dropping Dridex|
Sample in that pass : 310528e97a26f3fee05baea69230f8b619481ac53c2325da90345ae7713dcee2
Fiddler sent here
Out of topic payload : 99a6f5674b738591588416390f22dedd8dac9cf5aa14d0959208b0087b718902
Most likely Dridex 123 targeting Germany based on distribution path.
Sundown : 
Sample in that pass : cf6be39135d8663be5241229e0f6651f9195a7434202067616ae00712a4e34e6
Fiddler sent here (password : malware)
 CVE-2016-4117: Flash Zero-Day Exploited in the Wild - 2016-05-13 - Genwei Jiang - FireEye
 New Flash Vulnerability CVE-2016-4117 Shares Similarities With Older Pawn Storm Exploit - 2016-05-13 - Moony Li - TrendMicro
 Sundown EK – Stealing Its Way to the Top - 2016-09-02 - Spiderlabs
Magnitude CVE-2016-4117 Flash Player AnglerEK Exploit Kit Neutrino Exploit 220.127.116.11