Adobe Patches Actively Exploited Acrobat and Reader Zero-Day CVE-2026-34621
Summary
Adobe patched CVE-2026-34621, an actively exploited Acrobat and Reader flaw that can enable code execution. Researchers traced exploitation to at least November 2025; Adobe updated the CVSS score from 9.6 to 8.6.
Key points
- Adobe confirmed CVE-2026-34621 was exploited in the wild and said it can lead to code execution.
- The flaw affects Acrobat and Reader for Windows and macOS; exploitation requires opening a file locally.
- Adobe provided fixes in Acrobat DC and Reader DC version 26.001.21411, and Acrobat 2024 versions 24.001.30362 and 24.001.30360.
- Analysis of an exploit sample uploaded to VirusTotal indicated exploitation began as early as November 2025.
- Adobe revised the CVSS score from 9.6 (critical) to 8.6 (high), citing the requirement to open a file locally.
- Researcher Haifei Li said an APT was likely behind the attacks; an analyst noted Russian-language lures referencing events in Russia’s oil and gas sector.
Article Details
- Vulnerability Types
- Improperly controlled modifications to prototype attributes
- Severity
- High (CVSS 8.6; previously rated Critical with a score of 9.6)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
People
Gi7w0rmA threat intelligence analyst who noted that malicious PDFs used Russian-language lures and referenced current events in Russia’s oil and gas sector.Haifei LiReported the vulnerability and identified the zero-day while analyzing a PDF exploit uploaded to Expmon; he also made technical details available.
Vendors
Products
Acrobat 2024Patches are included in version 26.001.21411 of Acrobat DC and Acrobat Reader DC, and versions 24.001.30362 and 24.001.30360 of Acrobat 2024.Acrobat DCPatches are included in version 26.001.21411 of Acrobat DC and Acrobat Reader DC, and versions 24.001.30362 and 24.001.30360 of Acrobat 2024.Acrobat Reader DCPatches are included in version 26.001.21411 of Acrobat DC and Acrobat Reader DC, and versions 24.001.30362 and 24.001.30360 of Acrobat 2024.Adobe AcrobatAdobe on Saturday released emergency patches for a critical Acrobat and Reader zero-day that has been exploited in the wild for several months.Adobe Acrobat ReaderAdobe on Saturday released emergency patches for a critical Acrobat and Reader zero-day that has been exploited in the wild for several months.