CVE-2026-34621

Think of Adobe Acrobat Reader as a program that “understands” documents. This vulnerability is like a trick that can sneak extra instructions into a document so that, once someone opens it, the attacker can run harmful code on that same computer. In a business, that can mean attackers taking over what your logged-in user can do.

This affects businesses that have Adobe Acrobat DC or Adobe Acrobat installed and used by staff to open PDF files. It matters because the attacker’s path is mainly social/targeted: a user must open a malicious file for the code execution to occur.

Per the findings, there’s no known requirement for the attacker to already have an account, but the practical risk depends on whether an attacker can get someone to open a crafted document (the “user opens a malicious file” gate).

This is urgent because CISA has added CVE-2026-34621 to its KEV list, meaning it meets criteria for serious, actionable risk. The weakness can lead to arbitrary code execution when a user opens a malicious file, so delaying updates increases the chance a real-world attacker can succeed.

Follow the CISA KEV remediation due date of 2026-04-27 and update to the fixed Acrobat versions as soon as possible.

1. Confirm the affected software and version

   • Identify whether you run adobe acrobat dc or adobe acrobat on workstations.
   • In Acrobat, check the installed version number for each device (and for all user profiles that can launch it).

2. Determine whether you’re affected

   • adobe acrobat dc: affected if your version is 26.001.21367 and earlier (fixed in 26.001.21411).
   • adobe acrobat: affected if your version is 24.001.30356 and earlier (fixed in 24.001.30362).

3. Upgrade to the fixed versions

   • Update adobe acrobat dc to 26.001.21411 or later.
   • Update adobe acrobat to 24.001.30362 or later.
   • Use your normal enterprise software distribution method if applicable, and verify the resulting versions on the endpoints.

4. If patching is delayed (temporary risk reduction)

   • Until updated, enforce strict document handling: do not open unexpected PDFs, especially from email attachments, instant messages, or unexpected links.
   • Route external documents through your organization’s existing “safe open” process (for example, a controlled document workflow used by your IT team).

5. After updating

   • Re-check the Acrobat version numbers on all relevant endpoints.
   • Watch for any endpoint alerts related to suspicious child processes or unusual activity around times users open PDFs (use your endpoint monitoring tools).

Severity and type: High-risk memory/logic class issue categorized as Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321). Impact capability from the findings: Execute arbitrary code in the context of the current user.

Attack vector and prerequisites: Local exploitation path with no authentication required by the attacker, but user interaction is required—a victim must open a malicious file. The findings also indicate the victim code runs under the current user context.

Exploitation status: CISA KEV confirmed (listed 2026-04-13) with remediation due 2026-04-27. No dated press evidence or public exploit code was provided in the findings for this specific CVE.

EPSS note: A prediction exists (EPSS 7.1% with a rising trend), but KEV listing is the primary driver for urgency in this case.

What KEV means here: KEV indicates the vulnerability is considered actively relevant and actionable enough that CISA expects organizations to remediate by the stated deadline.

Fix availability: Vendor fixed releases are provided—adobe acrobat dc fixed in 26.001.21411 and adobe acrobat fixed in 24.001.30362—as referenced by the vendor security bulletin link in the findings.