CVE-2026-34621highunder attackCWE-1321

CVE-2026-34621: high-severity vulnerability in Adobe Acrobat 2024

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

Published · Updated

73Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.6epss 2.2%
from disclosure to weapon31 days
Published on NVDApr 11
1st PoC+31d
CISA KEV+2d
exploitation probability
2.2%top 18% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2026-04-27

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Acrobat Reader has a flaw where attackers can inject malicious code into core JavaScript objects through specially crafted PDF files. If you open an infected PDF, the attacker's code runs with your permissions.

Technical detail

Prototype pollution in Acrobat Reader (versions 24.001.30356, 26.001.21367 and earlier) allows unauthenticated attackers to modify JavaScript object prototypes via malicious PDF files. User interaction is required (opening the file); successful exploitation results in arbitrary code execution in the user's security context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Adobe · Acrobat 2024Adobe · Acrobat DCAdobe · Acrobat Reader DC
public PoCs found — 2
githubgithub.com/azefzafyoussef/CVE-2026-34621★ 20vulncheckvulncheck.com/xdb/1b66f0bec8c6unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Adobe Acrobat 2024

In the same product, most dangerous first.

CVE-2020-29075HIGHPDF Injection BlackHat TalkEPSS 7.9%CVE-2026-34622HIGHAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.7%CVE-2026-81994HIGHAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.6%CVE-2026-34626MEDIUMAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.6%CVE-2026-27220HIGHAcrobat Reader | Use After Free (CWE-416)EPSS 0.4%CVE-2026-27278HIGHAcrobat Reader | Use After Free (CWE-416)EPSS 0.4%
References
https://helpx.adobe.com/security/products/acrobat/apsb26-43.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621