{"id":"CVE-2026-34621","kind":"vulnerability","aliases":["CVE-2026-34621"],"related":[],"title":"Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification…","description":"Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Acrobat and Reader contain a prototype pollution flaw that lets a crafted input alter JavaScript object behavior inside the reader. The sources say it allows arbitrary code execution, and CISA lists it as actively exploited.","severity":"critical","cvss":8.6,"epss":null,"exploited":true,"exploited_at":"2026-04-13T00:00:00+00:00","products":[{"name":"Adobe Acrobat and Reader","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"adobe acrobat dc","fixed":["26.001.21411"],"affected":"< 26.001.21411","ecosystem":"vendor"},{"name":"adobe acrobat reader dc","fixed":["26.001.21411"],"affected":"< 26.001.21411","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["24.001.30362"],"affected":">= 24.0.0, < 24.001.30362","ecosystem":"vendor"},{"name":"adobe acrobat","fixed":["24.001.30360"],"affected":">= 24.0.0, < 24.001.30360","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-acrobat","adobe-reader","exploited","macos","vendor","windows"],"not_affected_if":[],"how_to_check":"Open Acrobat or Reader and check Help > About to see the installed version, then compare it against Adobe's security bulletin for the fixed build.","fix":"Update Adobe Acrobat and Reader to the fixed version named in Adobe's advisory; the sources do not name the version.\nCISA says to apply the vendor mitigations or discontinue use if none are available.","status":"open","published_at":"2026-04-11T07:16:03+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:54+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:38:54Z","model":"claude-haiku-5-5","output":{"fix":"Update Adobe Acrobat and Reader to the fixed version named in Adobe's advisory; the sources do not name the version.\nCISA says to apply the vendor mitigations or discontinue use if none are available.","reach":"unknown","summary":"Adobe Acrobat and Reader contain a prototype pollution flaw that lets a crafted input alter JavaScript object behavior inside the reader. The sources say it allows arbitrary code execution, and CISA lists it as actively exploited.","category":"vendor","who_cares":["adobe-acrobat","adobe-reader","windows","macos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the machine running Acrobat or Reader.","analyst_note":"Find Adobe's security bulletin for CVE-2026-34621 to get the fixed versions, the trigger (opening a PDF or not) and any mitigation steps.","how_to_check":"Open Acrobat or Reader and check Help > About to see the installed version, then compare it against Adobe's security bulletin for the fixed build.\nunknown\nunknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000475,"input_tokens":2532,"output_tokens":444,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-34621':17A,20A '24.001.30356':4A,85C '26.001.21367':5A,86C 'acrobat':1A,22A,26A,29A,33A,35A,38B,47B,82C 'activ':80B 'adob':37B,40B,46B 'adobe':21A,25A,28A,32A,34A 'adobe-acrobat':36B 'adobe-read':39B 'affect':9A,90C 'allow':71B 'alter':60B 'and':23A 'arbitrari':72B,107C 'attribut':99C 'behavior':63B 'cisa':76B 'code':73B,108C 'contain':50B 'context':112C 'control':13A,94C 'could':104C 'craft':58B 'current':115C 'cve':15A,18A 'dc':27A,31A 'earlier':7A,88C 'execut':74B,109C 'exploit':42B,81B,117C 'file':132C 'flaw':54B 'improp':12A,93C 'input':59B 'insid':64B 'interact':123C 'issu':120C 'javascript':61B 'let':56B 'list':77B 'maco':43B 'malici':131C 'modif':14A,95C 'must':128C 'object':62B,97C 'open':129C 'pollut':53B,101C 'prototyp':52B,98C,100C 'reader':2A,24A,30A,41B,49B,66B,83C 'requir':121C 'result':105C 'say':69B 'sourc':68B 'user':116C,122C 'vendor':44B 'version':3A,84C 'victim':127C 'vulner':102C 'window':45B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-11T07:16:03+00:00","kev":{"dateAdded":"2026-04-13","dueDate":"2026-04-27","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-34621","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34621","severity":null,"published_at":"2026-04-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-34621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34621","severity":null,"published_at":"2026-04-11T07:16:03+00:00","modified_at":"2026-08-28T00:17:16+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}