CVE-2026-34621
Adobe Acrobat and Reader Prototype Pollution Vulnerability
Description
CVE-2026-34621 is a HIGH-severity prototype pollution vulnerability in Adobe Acrobat and Acrobat Reader (versions 24.001.30356, 26.001.21367 and earlier) with a CVSS 3.1 score of 8.6. The flaw allows improperly controlled modification of object prototype attributes, which can be abused to achieve arbitrary code execution in the context of the user who opens a malicious PDF file. Because Adobe Acrobat and Reader are ubiquitous on enterprise desktops and are routinely used to open email attachments and downloaded documents, CVE-2026-34621 represents a realistic client-side attack vector. CISA added CVE-2026-34621 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-04-13 with a remediation deadline of 2026-04-27, and the EPSS score of 0.04558 (89.21st percentile) places it high among vulnerabilities expected to be exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | acrobat dc | < 26.001.21411 |
| adobe | acrobat reader dc | < 26.001.21411 |
| adobe | acrobat | >= 24.0.0, < 24.001.30362; >= 24.0.0, < 24.001.30360 |
References
- https://helpx.adobe.com/security/products/acrobat/apsb26-43.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621(US Government Resource)
Weakness Type
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVE-2026-34621 is classified under CWE-1321 — Prototype Pollution. In Adobe Acrobat and Reader, attacker-controlled input inside a crafted PDF can specify object attributes that the application merges into internal objects without properly restricting modification of prototype properties such as __proto__, constructor, or prototype. Because every object instance inherits from the prototype, a single malicious property can alter behavior across the application, bypass security checks, corrupt data flows, and — as in this case — lead to arbitrary code execution in the context of the current user.
Learn more: CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Impact Analysis
CVE-2026-34621 carries a CVSS 3.1 score of 8.6 (HIGH) with a changed scope, meaning successful exploitation can affect resources beyond the vulnerable Acrobat process itself. Attack Vector (Local): exploitation requires the victim to open a malicious file locally, but no network-level exposure is needed on the victim side — a delivered or downloaded PDF is sufficient. Attack Complexity (Low): once the file is opened, no further special conditions are required. Privileges Required (None): the attacker needs no credentials on the target system. User Interaction (Required): a victim must open the crafted PDF, which is a low bar in phishing and social-engineering scenarios. Confidentiality, Integrity, and Availability (all High): arbitrary code execution in the user's context allows reading, modifying, or destroying any data the user can access, installing persistence, and disrupting the workstation. With KEV listing confirming active exploitation and an EPSS score in the 89.21st percentile, CVE-2026-34621 should be treated as an urgent desktop-fleet patching priority.
Exploit Maturity
CVE-2026-34621 is confirmed to be actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-13 with a remediation deadline of 2026-04-27, a strong signal that real-world attack campaigns are leveraging malicious PDFs to trigger this prototype pollution flaw in Adobe Acrobat and Reader. The EPSS score of 4.56% at the 89.21st percentile indicates exploitation is well above average likelihood for a freshly catalogued flaw. KEV does not currently list known ransomware use for CVE-2026-34621, and no dedicated public proof-of-concept is linked from NVD references beyond the Adobe advisory (APSB26-43), but given the user-facing attack surface and active exploitation, defenders should patch Acrobat and Reader without delay and monitor email gateways for weaponized PDFs.
Remediation
- Follow CISA's KEV directive. Apply mitigations per Adobe's instructions in security bulletin APSB26-43, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of Adobe Acrobat and Reader if fixes cannot be deployed — the remediation deadline is 2026-04-27.
- Update Adobe Acrobat and Reader to the fixed builds. Deploy the fixed versions referenced in APSB26-43: Acrobat DC and Acrobat Reader DC at 26.001.21411 or later, and Acrobat (continuous / classic tracks) at 24.001.30362 and 24.001.30360 or later. Use your endpoint management or software-distribution tooling (Intune, SCCM, Jamf, etc.) to enforce the rollout across the fleet.
- Block or quarantine untrusted PDFs during the rollout window. Tighten email gateway policies to sandbox or strip PDFs from unknown senders, and consider temporarily routing PDF previews through server-side rendering or a hardened viewer until all endpoints are patched.
- Enable Protected View and Protected Mode as a layered defense. Enforce Adobe Acrobat/Reader's Protected View for files from the internet and Protected Mode (sandbox) via GPO or an equivalent MDM policy to contain exploitation attempts even if a user opens a malicious PDF.
- Hunt for signs of exploitation. Review EDR telemetry for suspicious child processes spawned by
Acrobat.exeorAcroRd32.exe(shells, script interpreters, LOLBins), unexpected script or DLL writes in user profiles, and outbound connections immediately after a PDF is opened. Correlate with recent phishing or suspicious-attachment reports. - Apply CWE-1321 hardening in your own code. For internally developed PDF-processing or JavaScript-handling code, freeze sensitive prototypes via
Object.freeze(Object.prototype), filter__proto__/constructor/prototypefrom parsed input, and preferObject.create(null)orMapfor untrusted key/value data to prevent similar prototype pollution issues.
Technical Details
CVE-2026-34621 is a prototype pollution vulnerability in Adobe Acrobat and Acrobat Reader that affects versions 24.001.30356, 26.001.21367 and earlier, and is triggered when the application processes a specially crafted PDF file. As described by CWE-1321, the root cause is that the application accepts input specifying object attributes but does not properly control modifications of the underlying object prototype — injection of properties via __proto__, constructor, or prototype can modify every object instance in the application, override critical attributes, and alter control flow in ways that ultimately enable arbitrary code execution in the context of the current user. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H reflects an attack that is local (requires a local file to be opened), has low complexity, requires no privileges but requires user interaction, and — notably — has a changed scope, meaning exploitation impact can extend beyond the Acrobat sandbox into the broader user session. The Adobe security bulletin APSB26-43 is the authoritative source for affected builds and fixed versions.
Frequently Asked Questions
Is CVE-2026-34621 being actively exploited?
Yes. CVE-2026-34621 is listed in CISA's Known Exploited Vulnerabilities catalog, with a remediation deadline of 2026-04-27, which confirms active in-the-wild exploitation. The EPSS score of 4.56% (89.21st percentile) further indicates above-average likelihood of ongoing exploitation.
What products are affected by CVE-2026-34621?
CVE-2026-34621 affects Adobe Acrobat DC and Acrobat Reader DC in versions prior to 26.001.21411, and Adobe Acrobat (continuous / classic tracks) from 24.0.0 up to — but not including — 24.001.30362 and 24.001.30360. Adobe's APSB26-43 advisory lists the complete set of affected and fixed builds.
How do I fix CVE-2026-34621?
Update Adobe Acrobat and Reader to the fixed versions listed in Adobe bulletin APSB26-43 (26.001.21411 / 24.001.30362 / 24.001.30360 or later) across your endpoint fleet. Until every endpoint is patched, enforce Acrobat Protected View and Protected Mode, and restrict or sandbox PDFs from untrusted sources at the email gateway.
How severe is CVE-2026-34621?
CVE-2026-34621 is rated HIGH with a CVSS 3.1 score of 8.6, a changed scope, and high confidentiality, integrity, and availability impact — meaning a single malicious PDF can lead to arbitrary code execution that extends beyond the Acrobat process itself. Combined with active KEV status and an EPSS percentile of 89.21, it should be prioritized for rapid patching.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.