CVE-2026-34621

9.6

CRITICAL CVSS 3.1

Adobe Acrobat and Reader Prototype Pollution Vulnerability - [Actively Exploited]

Overview

Description

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Details

INFO

Published Date :

April 11, 2026, 7:16 a.m.

Last Modified :

April 13, 2026, 9:23 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Apr 27, 2026

Alert Date: Apr 13, 2026 | 18 days ago

Description :

Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

Impact

Affected Products

The following products are affected by CVE-2026-34621 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Adobe	acrobat_dc
2	Adobe	acrobat_reader_dc
3	Adobe	acrobat
4	Adobe	acrobat_reader
1	Apple	macos
1	Microsoft	windows

: Total Affected Vendor : 3 | Products : 6

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	CRITICAL	078d4453-3bcd-4900-85e6-15281da43538
CVSS 3.1	CRITICAL	[email protected]
CVSS 3.1	HIGH	[email protected]

Solution

Update Acrobat Reader to a non-vulnerable version to prevent arbitrary code execution.

Update Adobe Acrobat Reader to the latest version.
Ensure all users update their Reader software.
Educate users about opening malicious files.

Public PoC/Exploit Available at Github

CVE-2026-34621 has a 9 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-34621.

URL	Resource
https://helpx.adobe.com/security/products/acrobat/apsb26-43.html	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-34621 is associated with the following CWEs:

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-34621 weaknesses.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs Accessing Functionality Not Properly Constrained by ACLs CAPEC-77: Manipulating User-Controlled Variables Manipulating User-Controlled Variables CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels Exploiting Incorrectly Configured Access Control Security Levels

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

dajneem23/CVE-2026-3462

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

Python

Updated: 1 week, 4 days ago

0 stars 0 fork 0 watcher

Born at : April 20, 2026, 8:11 a.m. This repo has been linked 1 different CVEs too.

ercihan/CVE-2026-34621_PDF_SAMPLE

None

Updated: 2 weeks ago

1 stars 0 fork 0 watcher

Born at : April 17, 2026, 8:07 a.m. This repo has been linked 1 different CVEs too.

NULL200OK/cve_2026_34621_advanced

A sophisticated, cross-platform exploit generator for **CVE-2026-34621** – a critical prototype pollution vulnerability in Adobe Acrobat and Reader that leads to sandbox escape and arbitrary code execution on Windows and macOS.

Python

Updated: 2 weeks ago

2 stars 0 fork 0 watcher

Born at : April 15, 2026, 3:30 p.m. This repo has been linked 1 different CVEs too.

taizone35/news

None

JavaScript

Updated: 6 days, 12 hours ago

0 stars 0 fork 0 watcher

Born at : April 15, 2026, 3:13 a.m. This repo has been linked 3 different CVEs too.

KeulenR01/Remediate-AdobeAcrobat-CVE-2026-34621

None

PowerShell

Updated: 2 weeks, 1 day ago

1 stars 0 fork 0 watcher

Born at : April 14, 2026, 3:14 p.m. This repo has been linked 1 different CVEs too.

eduardorossi84/CVE-2026-34621-POC

Updated: 2 weeks, 3 days ago

1 stars 0 fork 0 watcher

Born at : April 13, 2026, 7:23 p.m. This repo has been linked 1 different CVEs too.

ercihan/CVE-2026-34621

None

Updated: 2 weeks ago

1 stars 0 fork 0 watcher

Born at : April 13, 2026, 1 p.m. This repo has been linked 1 different CVEs too.

MaikCyberSec/Threat-Hunting-

Threat Hunting based on KQL

Updated: 1 week ago

5 stars 0 fork 0 watcher

Born at : Feb. 18, 2026, 8:20 a.m. This repo has been linked 9 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 6 days, 6 hours ago

7667 stars 1247 fork 1247 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 749 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-34621 vulnerability anywhere in the article.

Help Net Security

Week in review: Acrobat Reader flaw exploited, Claude Mythos offensive capabilities and limits

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Bringing governance and visibility to machine and AI identities In this Help Net Security interview, A ...

Published Date: Apr 19, 2026 (1 week, 5 days ago)

TheCyberThrone

Microsoft Defender Under Siege

OverviewThree zero-day exploits targeting Microsoft Defender — BlueHammer, RedSun, and UnDefend — have been confirmed exploited in the wild by threat actors. All three were publicly released on GitHub ...

Published Date: Apr 18, 2026 (1 week, 6 days ago)

TheCyberThrone

Fortinet FortiSandbox — Critical Vulnerability Advisory

April 16, 2026Fortinet published a sweeping security advisory on April 14, 2026, disclosing multiple vulnerabilities across its FortiSandbox platform. Two of the flaws are rated Critical with unauthen ...

Published Date: Apr 16, 2026 (2 weeks ago)

The Hacker News

April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More

A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases. Topping the list is an SQL injection vulnera ...

Published Date: Apr 15, 2026 (2 weeks, 2 days ago)

The Cyber Express

Ivanti Neurons ITSM Vulnerabilities Could Allow Session Persistence

A newly disclosed set of ITSM vulnerabilities in Ivanti Neurons has been reported. The flaws could allow attackers to retain access to enterprise systems under certain conditions. The issues, tracked ...

Published Date: Apr 15, 2026 (2 weeks, 2 days ago)

The Cyber Express

Microsoft Fixes 167 Vulnerabilities in Latest Patch Tuesday Update

Microsoft’s Patch Tuesday April 2026 release has introduced one of the most extensive security update rollouts of the year, addressing a total of 167 vulnerabilities across Windows operating systems a ...

Published Date: Apr 15, 2026 (2 weeks, 2 days ago)

TheCyberThrone

Microsoft Patch Tuesday — April 2026

TheCyberThrone | Vulnerability Advisory | April 15, 2026Volume & Scale — A Near-Record ReleaseMicrosoft patched 163 CVEs in the April 2026 Patch Tuesday release — the second largest Patch Tuesday on r ...

Published Date: Apr 15, 2026 (2 weeks, 2 days ago)

Daily CyberSecurity

CISA Adds 7 Fresh Exploits to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog, adding seven high-risk flaws that are currently being weaponized by maliciou ...

Published Date: Apr 14, 2026 (2 weeks, 3 days ago)

security.nl

NCSC verwacht grootschalig misbruik van kritiek Adobe Acrobat-lek

Het Nationaal Cyber Security Centrum (NCSC) verwacht op korte termijn grootschalig misbruik van een kritieke kwetsbaarheid in Adobe Acrobat, nu proof-of-concept exploitcode op internet is verschenen. ...

Published Date: Apr 14, 2026 (2 weeks, 3 days ago)

The Cyber Express

Hackers Exploit Kali Forms Vulnerability to Take Over WordPress Sites

A recently disclosed Kali Forms vulnerability affecting a widely used WordPress plugin has escalated into an active security threat, enabling unauthenticated attackers to achieve Remote Code Execution ...

Published Date: Apr 14, 2026 (2 weeks, 3 days ago)

TheCyberThrone

CISA Adds Seven Vulnerabilities to KEV Catalog — April 13, 2026

CISA has expanded the Known Exploited Vulnerabilities catalog with seven new entries on April 13, 2026, based on evidence of active exploitation. The batch spans three vendors — Microsoft, Adobe, and ...

Published Date: Apr 14, 2026 (2 weeks, 3 days ago)

The Register

Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum

Crooks are exploiting four Microsoft vulnerabilities - one patched 14 years ago and another tied to ransomware activity - according to America's lead cyber-defense agency, which on Monday gave federal ...

Published Date: Apr 13, 2026 (2 weeks, 3 days ago)

Help Net Security

Hackers hijacked CPUID downloads, served STX RAT to victims

If you tried to download software from CPUID’s website late last week, you might have downloaded malware instead. “Investigations are still ongoing, but it appears that a secondary feature (basically ...