CVE-2026-47937highCWE-427

CVE-2026-47937: high-severity vulnerability in Adobe Acrobat 2024

Acrobat Reader | Uncontrolled Search Path Element (CWE-427)

Published · Updated

Follow this CVE+ Monitor Adobe Acrobat+ Monitor Acrobat Reader DC

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 0.2%
Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected products
Adobe · Acrobat 2024Adobe · Acrobat DCAdobe · Acrobat Reader DC
Related CVEs — Adobe Acrobat 2024

In the same product, most dangerous first.

CVE-2026-34621HIGHAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 7.2%KEVCVE-2020-29075HIGHPDF Injection BlackHat TalkEPSS 7.9%CVE-2026-81994HIGHAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.6%CVE-2026-34622HIGHAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.4%CVE-2026-81989HIGHAcrobat Reader | Use After Free (CWE-416)EPSS 0.4%CVE-2026-81990HIGHAcrobat Reader | Use After Free (CWE-416)EPSS 0.4%