CVE-2026-34621

CVE Enrichment

CVSS: 8.6 HIGH
EPSS: 7.23%
EPSS Percentile: 94.35%
CISA KEV: YES — Known Exploited Vulnerability

Description

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 11-Apr-2026 14:16
Last Modified: 27-Oct-2026 04:10
EPSS Date: 2026-11-05
CWE: CWE-1321

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-04-13
Remediation Due: 2026-04-27
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

CNA Products / Version Status

Adobe · Acrobat 2024 Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 24.001.30356 — affected (custom)
24.001.30362 (Win), 24.001.30360 (Mac) — unaffected (custom)
Adobe · Acrobat DC Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 26.001.21367 — affected (custom)
26.001.21411 — unaffected (custom)
Adobe · Acrobat Reader DC Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 26.001.21367 — affected (custom)
26.001.21411 — unaffected (custom)

Affected Products / Versions

adobe / acrobat_dc Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 26.001.21411
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*
adobe / acrobat_reader_dc Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 26.001.21411
cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*
adobe / acrobat Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 24.0.0 · before (exclusive) 24.001.30362
cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*
adobe / acrobat Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 24.0.0 · before (exclusive) 24.001.30360
cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*

References

Last enrichment sync: 05-Nov-2026 23:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (6)

Notable stories include agentic memory attacks spreading across sessions and users and a zero-day in Adobe Acrobat Reader (CVE-2026-34621) exploited in the wild. Week in review: Acrobat Reader zero-day, AI agent risks and security developments
Adobe Acrobat Reader (CVE-2026-34621) is facing active in-the-wild RCE exploitation while FortiSandbox and Microsoft SharePoint Server also received fixes for high-severity flaws. April Patch Tuesday Updates Address Critical Flaws Across Major Vendors
However, a few days ago Adobe announced patches for CVE-2026-34621, an Acrobat and Reader zero-day that appears to have been exploited for several months. Adobe Patches 55 Vulnerabilities Across 11 Products
Adobe released an emergency update for Acrobat and Acrobat Reader to fix CVE-2026-34621, a zero-day exploited since at least December that lets malicious PDFs bypass sandboxing and invoke privileged JavaScript APIs. Adobe Patches Acrobat Zero-Day Exploited Through Malicious PDFs
Adobe has released emergency updates for Acrobat and Acrobat Reader to address a critical zeroâday vulnerability (CVE-2026-34621) that is being actively exploited in the wild. Adobe Patches Actively Exploited Acrobat Flaw CVE-2026-34621

CVE (10)

Malware (1)

People (4)

MITRE ATT&CK (5)

Vendors (6)

Products (21)

Tools (3)

Industries (2)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.