CVE-2026-34621: Adobe Acrobat Reader prototype pollution leads to code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed in-the-wild exploitation, allows arbitrary code execution, and has a near-term federal remediation deadline of 2026-04-27.

What it is

Adobe Acrobat and Reader (versions 24.001.30356, 26.001.21367 and earlier) are affected by prototype pollution (CWE-1321) that can result in arbitrary code execution in the context of the current user. The flaw is triggered when a victim opens a malicious file, so it is a client-side code execution issue that matters to any organization with Acrobat or Reader deployed on endpoints.

Impact

An attacker who gets a victim to open a crafted file can execute arbitrary code with the victim's privileges, giving full control of the user's session and data. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached locally via a malicious file opened in Acrobat or Reader; the vector is AV:L/PR:N/UI:R, so no authentication is required but user interaction (opening the file) is mandatory. Delivery is likely through email attachments, downloads or web-hosted PDFs, though the record does not specify the delivery channel.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-13 with a remediation due date of 2026-04-27, indicating exploitation in the wild; EPSS 30-day probability is 0.07086 (93.9th percentile). No ransomware campaign use is documented.

What to do

• Update Acrobat and Reader to the fixed versions listed in Adobe security bulletin apsb26-43; patch is the primary action.
• If patching cannot be completed before the CISA due date, apply the mitigations in the vendor advisory or discontinue use of the affected product per BOD 22-01 guidance.
• Restrict opening of untrusted PDFs and other files that invoke Acrobat or Reader, and block or sandbox such attachments at the email and web gateways.
• Enable Acrobat protected view/Enhanced Security and disable JavaScript where operationally feasible to reduce the attack surface.
• Track patch compliance for Acrobat and Reader across endpoints and prioritize internet-facing or high-value user systems.

Detection

• Monitor for Acrobat or Reader child processes spawning unusual executables, scripts or command shells after a document is opened.
• Hunt for suspicious PDF files delivered via email or download that are opened shortly before anomalous process creation on the same host.
• Review endpoint telemetry for prototype-pollution-related crashes or abnormal memory behavior in Acrobat/Reader processes.
• Check for known exploitation indicators against the CISA KEV entry and Adobe advisory, and alert on repeated attempts to open untrusted documents.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.