Adobe Addresses Critical Acrobat Reader Vulnerability CVE-2026-34621

Adobe has released emergency updates to address a critical security flaw in Acrobat Reader, identified as CVE-2026-34621. This vulnerability has been assigned a CVSS score of 8.6 out of 10.0, indicating a high severity level. It allows attackers to execute arbitrary code on affected systems, primarily through specially crafted PDF documents. The flaw is categorized as a prototype pollution issue, which enables manipulation of JavaScript objects and properties within the application.

Adobe Fixes Acrobat Reader Flaw Zero-Day CVE-2026Adobe Fixes Critical Acrobat Reader Vulnerability CVE-2026-34621Adobe Fixes Critical Acrobat Reader Flaw Exploited in the Wild

The vulnerability impacts several versions of Adobe products across both Windows and macOS platforms, specifically:

Adobe Fixes Critical Acrobat Reader Vulnerability CVE-2026-34621

• Acrobat DC versions 26.001.21367 and earlier (fixed in version 26.001.21411)

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621

• Acrobat Reader DC versions 26.001.21367 and earlier (fixed in version 26.001.21411)

Adobe Fixes Acrobat Reader Flaw Zero-Day CVE-2026

• Acrobat 2024 versions 24.001.30356 and earlier (fixed in versions 24.001.30362 for Windows and 24.001.30360 for macOS)

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621

Adobe classified the update under bulletin APSB26-43, published on April 11, 2026, with a priority rating of 1, indicating the highest urgency for patch deployment.

Adobe Fixes Acrobat Reader Flaw Zero-Day CVE-2026

Adobe has confirmed awareness of CVE-2026-34621 being actively exploited in the wild, with evidence suggesting that attacks may have been ongoing since December 2025. Security researcher Haifei Li, founder of EXPMON, disclosed details regarding the zero-day exploitation, indicating that attackers could run malicious JavaScript code by opening infected PDF files. This exploitation method requires minimal user interaction, heightening the risk for both individual and enterprise users.

Adobe Fixes Critical Acrobat Reader Vulnerability CVE-2026-34621

Adobe has acknowledged the severity of the vulnerability, stating, “We are aware of CVE-2026-34621 being exploited in the wild.” The company has urged users to update their software immediately to mitigate risks associated with this critical flaw. The initial CVSS score of 9.6 was revised to 8.6 following a reassessment of the attack vector, which changed from network-based (AV:N) to local (AV:L).

Adobe Fixes Acrobat Reader Flaw Zero-Day CVE-2026

While Adobe has taken steps to address the vulnerability, some cybersecurity experts have criticized the company for the delay in releasing patches. The fact that the vulnerability may have been exploited for several months before public acknowledgment raises concerns about the effectiveness of Adobe's security protocols.

Adobe Patches Actively Exploited Acrobat Reader Zero-Day Vulnerability

• “It appears that Adobe has determined the bug can lead to arbitrary code execution — not just an information leak,” — EXPMON

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621

• “30360 (macOS) Adobe recommends immediate updating via built-in update mechanisms (Help > Check for Updates) or through managed deployment systems in enterprise environments such as AIP-GPO, SCUP/SCCM, Apple Remote Desktop, or SSH-based workflows on macOS.” — Adobe Advisory

Adobe Fixes Acrobat Reader Flaw Zero-Day CVE-2026

In light of the ongoing exploitation, organizations and users are encouraged to prioritize the installation of the latest updates to protect against potential attacks leveraging CVE-2026-34621. Continuous monitoring and proactive cybersecurity measures are essential to safeguard systems from evolving threats.

Adobe Patches Actively Exploited Acrobat Reader Zero-Day Vulnerability