CVE-2026-34621: Adobe Acrobat and Reader prototype pollution in JavaScript engine

CVE-2026-34621 · Severity: critical · CVSS 8.6 · Exploited in the wild · Published 2026-04-11

Adobe Acrobat and Reader, widely used applications for viewing and editing PDF documents, are affected by a critical security flaw. An attacker can exploit this vulnerability to take control of a user's computer if the user opens a specially crafted malicious file. This vulnerability is reportedly being used in active attacks, making immediate updates essential to protect sensitive data and system integrity.

Technologies: Adobe Acrobat, Adobe Acrobat Reader, Adobe AIR, Adobe Flash Player, Adobe Reader. Vendors: Adobe.

Quick answers

Is CVE-2026-34621 exploited in the wild?
Yes. CVE-2026-34621 is known to be exploited in the wild, first recorded on 13 April 2026. Treat it as urgent.
How severe is CVE-2026-34621?
Critical severity, with a CVSS score of 8.6, published 11 April 2026.
Which products and versions are affected?
Adobe Acrobat 24.001.30356 and earlier, 26.001.21367 and earlier; Adobe Acrobat Reader 24.001.30356 and earlier, 26.001.21367 and earlier.
Is there a fix for CVE-2026-34621?
A patch was published on 2026-04-13: Vendor advisory APSB26-43 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34621 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-34621?
Check whether you run Adobe Acrobat, Adobe Acrobat Reader, Adobe AIR or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability (CWE-1321) is caused by the improperly controlled modification of object prototype attributes, commonly known as prototype pollution, within the Adobe Acrobat and Reader JavaScript engine. An attacker can exploit this by delivering a malicious PDF file that, when opened by a victim, modifies the application's base object structure to execute arbitrary code in the context of the current user. The attack requires local file access and user interaction (opening the file). Adobe has released security updates (APSB26-43) to address this issue, which is confirmed to be exploited in the wild.

Affected products

  • Adobe Acrobat 24.001.30356 and earlier, 26.001.21367 and earlier
  • Adobe Acrobat Reader 24.001.30356 and earlier, 26.001.21367 and earlier

Timeline

  • 2026-04-11: disclosed: Initial NVD publication
  • 2026-04-13: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2026-04-13: patched: Vendor advisory APSB26-43 released

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.