---
id: "CVE-2026-34621"
kind: "vulnerability"
aliases: ["CVE-2026-34621"]
title: "Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification\u2026"
severity: "critical"
cvss: 8.6
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Adobe Acrobat and Reader", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "adobe acrobat dc", "fixed": ["26.001.21411"], "affected": "< 26.001.21411", "ecosystem": "vendor"}, {"name": "adobe acrobat reader dc", "fixed": ["26.001.21411"], "affected": "< 26.001.21411", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": ["24.001.30362"], "affected": ">= 24.0.0, < 24.001.30362", "ecosystem": "vendor"}, {"name": "adobe acrobat", "fixed": ["24.001.30360"], "affected": ">= 24.0.0, < 24.001.30360", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-acrobat", "adobe-reader", "exploited", "macos", "vendor", "windows"]
not_affected_if: []
published_at: "2026-04-11T07:16:03+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34621", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34621", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification…

Adobe Acrobat and Reader contain a prototype pollution flaw that lets a crafted input alter JavaScript object behavior inside the reader. The sources say it allows arbitrary code execution, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Acrobat and Reader affected ? fixed ?
- vendor:adobe acrobat dc affected < 26.001.21411 fixed 26.001.21411
- vendor:adobe acrobat reader dc affected < 26.001.21411 fixed 26.001.21411
- vendor:adobe acrobat affected >= 24.0.0, < 24.001.30362 fixed 24.001.30362
- vendor:adobe acrobat affected >= 24.0.0, < 24.001.30360 fixed 24.001.30360

## How to check

Open Acrobat or Reader and check Help > About to see the installed version, then compare it against Adobe's security bulletin for the fixed build.

## Fix

Update Adobe Acrobat and Reader to the fixed version named in Adobe's advisory; the sources do not name the version.
CISA says to apply the vendor mitigations or discontinue use if none are available.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34621
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-34621

## From the sources

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_