High severity · published Apr 11, 2026
CVE-2026-34621
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
In wildKEV
8.6
CVSS
7.2%
EPSS
Yes
On KEV
Description
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)7.2% · higher than 94% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 13, 2026
Federal remediation dueApr 27, 2026
Ransomware campaign useNot known
Affected products
Which versions
A2
Acrobat 2024 · Adobe
through 24.001.30356 · source: vendor
AD
Acrobat DC · Adobe
through 26.001.21367 · source: vendor, NVD
AR
Acrobat Reader DC · Adobe
through 26.001.21367 · source: vendor, NVD
AC
Acrobat · Adobe
24.0.0 before 24.001.30362; 24.0.0 before 24.001.30360 · source: NVD
AA
Acrobat and Reader · Adobe
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2026-34621: Adobe Acrobat and Reader - Adobe Acrobat and Reader Prototype Pollution Vulnerability
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
AAAcrobat and ReaderCVE-2026-34621
Apr 13, 2026·CISA KEV
VulnerabilityCritical
Adobe fixes actively exploited Acrobat Reader flaw CVE-2026-34621
Adobe addressed a critical Acrobat Reader vulnerability, tracked as CVE-2026-34621, which is actively exploited to run malicious code. Adobe released emergency updates to address a critical vulnerability, tracked as CVE-2026-34621 (CVSS score of 8.6), in Adobe Acrobat Reader, which is being actively exploited. The flaw could allow attackers to execute malicious code on affected systems, […]
Apr 12, 2026·Security Affairs
VulnerabilityCritical
Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621
Adobe has released emergency updates to fix a critical security flaw in Acrobat Reader that has come under active exploitation in the wild.
The vulnerability, assigned the CVE identifier CVE-2026-34621, carries a CVSS score of 8.6 out of 10.0. Successful exploitation of the flaw could allow an attacker to run malicious code on affected installations.
It has been described as
Apr 12, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34621
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34621
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://helpx.adobe.com/security/products/acrobat/apsb26-43.html
More from Acrobat 2024
8.8
CVE-2026-81996
Acrobat Reader | Incorrect Authorization (CWE-863)
8.6
CVE-2026-34622
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
7.8
CVE-2026-81989
Acrobat Reader | Use After Free (CWE-416)
7.8
CVE-2026-81980
Acrobat Reader | Out-of-bounds Write (CWE-787)
7.8
CVE-2026-81990
Acrobat Reader | Use After Free (CWE-416)