cbcvebase.
CVE-2026-34621
published 2026-04-11

CVE-2026-34621: Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype…

PriorityP183high8.6CVSS 3.1
AVLACLPRNUIRSCCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-04-27
Exploited in the wild
EPSS
7.09%
93.5th percentile
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected

5 ranges
VendorProductVersion rangeFixed in
adobeacrobat>= 24.0.0 < 24.001.3036224.001.30362
adobeacrobat>= 24.0.0 < 24.001.3036024.001.30360
adobeacrobat_dc< 26.001.2141126.001.21411
adobeacrobat_reader<= 26.001.21367
adobeacrobat_reader_dc< 26.001.2141126.001.21411

Detection & IOCsextracted from sources · hover to see the quote

commandutil.readFileIntoStream()
commandRSS.addFeed()
  • Flag PDF files invoking privileged JavaScript APIs util.readFileIntoStream() and RSS.addFeed() — these are the specific APIs abused by the in-the-wild exploit to read local files and exfiltrate data.
  • Hunt for the known malicious PDF sample filename 'yummy_adobe_exploit_uwu.pdf' in email gateways, endpoint telemetry, and sandbox submissions; it was submitted to VirusTotal on or around March 23, 2026 with only 5/64 detections at the time.
  • Threat actors used Russian-language PDF lure documents themed around the oil and gas industry; filter for such documents in email and web proxy logs as a targeting indicator.
  • The exploit bypasses Adobe Reader sandbox restrictions to invoke privileged JavaScript APIs — monitor for Adobe Reader child processes or API calls that escape the sandbox boundary.
  • No user interaction beyond opening the malicious PDF is required; any Adobe Reader process spawning network or file-read activity immediately upon document open should be treated as suspicious.
  • Active exploitation has been observed since at least December 2025 / November 2025; retrospectively hunt endpoint and network logs from that period for indicators of compromise.
  • ·Adobe revised the CVSS score and attack vector after initial publication — the attack vector was changed from Network (AV:N) to Local (AV:L), lowering the score from 9.6 to 8.6. Detection rules or risk scoring based on the original network vector should be updated accordingly.
  • ·Affected versions span both Windows and macOS; ensure detection and patching coverage applies to both platforms. Fixed versions differ by OS for Acrobat 2024 (Windows: 24.001.30362, macOS: 24.001.30360).
  • ·No workarounds or mitigations exist; patching is the only recommended remediation action. CISA remediation due date is 2026-04-27.

CVSS provenance

nvdv3.18.6HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vulncheck9.6CRITICAL
cisa8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.