Acrobat Reader zero-day exploited in the wild for many months (CVE-2026-34621)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-34621 | Actively Exploited Prototype Pollution RCE in Adobe Acrobat and Reader | 8.6 | 7% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 169.40.2.68 | an block the two attacker-controlled servers/IP addresses ( 169.40.2.68 and 188.214.34.20 ). Better yet, they should block all http |
| ipv4 | 188.214.34.20 | attacker-controlled servers/IP addresses ( 169.40.2.68 and 188.214.34.20 ). Better yet, they should block all http/https traffic tha |
From the original article
2 min read at helpnetsecurity.com
Unknown attackers have exploited a zero-day Adobe Acrobat Reader vulnerability since November 2025 and possibly even earlier, security researcher Haifei Li has discovered. Haifei Li is one of the creators of EXPMON, a sandbox-based cybersecurity system for detecting advanced file-based exploits. It does so by analyzing suspicious files submitted through its public web interface or API.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.