CVE-2026-34621
Published 2026-04-11 · Updated 2026-10-26 · Source psirt@adobe.com
Summary
CVE-2026-34621 is a high-severity (CVSS 8.6) vulnerability in Adobe Acrobat and Reader. CISA added it to the Known Exploited Vulnerabilities catalog on April 13, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 27, 2026. CISA does not currently list it as used in ransomware campaigns. Adobe has 83 vulnerabilities in the KEV catalog, 11 of them linked to ransomware.
All 83 known-exploited Adobe vulnerabilities →Description
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Adobe — Acrobat and Reader
Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
Date added: 2026-04-13 · Due: 2026-04-27
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.