Adobe issues emergency fix for Acrobat Reader flaw exploited in the wild (CVE-2026-34621)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-34621 | Actively Exploited Prototype Pollution RCE in Adobe Acrobat and Reader Adobe Acrobat and Acrobat Reader are affected by a prototype pollution vulnerability (CWE-1321) in which improperly controlled modification of object prototype attributes can lead to arbitrary code execution in the context of the current user. Attackers trigger the flaw by convincing a victim to open a malicious file, typically a crafted PDF, so user interaction is required. Successful exploitation yields code execution as the victim, with the CVSS scope-changed metric indicating impact that extends beyond the vulnerable component. Anyone running Acrobat or Reader versions 24.001.30356 or earlier or 26.001.21367 or earlier is affected. The flaw is being actively exploited in the wild — reportedly via malicious PDFs since December 2025 as a zero-day — and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-13 after fixes shipped in Adobe's April 2026 Patch Tuesday release; EPSS assigns a 7.1% probability of exploitation within 30 days (94th percentile). Do: Upgrade Acrobat and Reader to a version later than 24.001.30356 (24.001 series) or 26.001.21367 (26.001 series) via Adobe's April 2026 security update, and audit installed versions across all endpoints. As a CISA KEV entry, US federal agencies must apply the vendor mitigations per BOD 22-01 guidance or discontinue use of the product if mitigations are unavailable. Until patched, treat PDFs from untrusted sources with caution and monitor for suspicious child-process activity spawned by Acrobat/Reader when files are opened. | 8.6 | 7% | KEV |
| masshundreds of millions of Acrobat/Reader installations worldwide, with likely millions still unpatched |
Full article318 words · extracted from helpnetsecurity.com · click to collapse
Adobe has pushed out an emergency security update for Adobe Acrobat Reader, patching a zero-day vulnerability (CVE-2026-34621) exploited in the wild since November 2025.
About CVE-2026-34621
CVE-2026-34621 is a critical prototype pollution vulnerability – a type of vulnerability that occurs in JavaScript and allows attackers to add or modify an application’s JavaScript objects and properties.
CVE-2026-34621 can lead to arbitrary code execution in the context of the current user, but it cannot be triggered remotely.
“Exploitation of this issue requires user interaction in that a victim must open a malicious file,” the vulnerability’s NVD entry states.
Its in-the-wild exploitation was flagged by security researcher Haifei Li, after someone submitted a malicious PDF sample to EXPMON, a publicly available system for detecting advanced file-based exploits.
The analysis of that and another related malicious PDF file revealed that, once opened, they would “fingerprint” the underlying system and send the information to a command and control (C2) server operated by the attackers.
The exploit can also launch additional exploits received from the C2 server but Li was unable to trigger this step.
An analysis by malware researcher Giuseppe Massaro has shown that both malicious PDFs contained text in Russian related to gas supply disruption and emergency response.
Update ASAP!
Adobe has addressed CVE-2026-34621 across several product versions:
- Acrobat DC and Acrobat Reader DC v26.001.21411 (for Windows and macOS), and
- Acrobat 2024 versions 24.001.30362 (for Windows) and 24.001.30360 (for macOS).
The company recommends admins to install the update as soon as possible.
If immediate patching is not feasible, Li and Massaro say that users should be instructed not to open PDF files sent by untrusted parties, and security teams should monitor endpoints for specific changes and block all http/https traffic that has the “Adobe Synchronizer” string in the User Agent field.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/04/13/adobe-acrobat-reader-cve-2026-34621-emergency-fix/