Adobe Acrobat Reader Prototype Pollution Arbitrary Code Execution Vulnerability (CVE-2026-34621)

Affected Vendors

adobe

Affected Components

acrobat reader, acrobat

Published Date

2026-04-11

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier

Impact

Successful exploitation allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious PDF file

Mitigation

Immediately apply the official Adobe security update (APSB26-43) and restrict opening untrusted PDF documents

Affected Products & Version Scope

Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier (Windows and macOS)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Apply Official Security Patch

Update Adobe Acrobat Reader to the latest secure version immediately via the official Adobe Security Bulletin APSB26-43.

Open Acrobat Reader -> Go to Help -> Click Check for Updates

2. Temporary Enterprise Mitigation (Disable Acrobat JavaScript)

If immediate patching is not feasible, disable Acrobat JavaScript to block the primary attack vector.

Via Windows Registry:

cmd

reg add "HKCU\Software\Adobe\Acrobat Reader\DC\JSP" /v "bEnableJS" /t REG_DWORD /d 0 /f

Via macOS Terminal:

bash

defaults write com.adobe.Reader DC.FeatureLockdown.bEnableJS -bool false

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

This vulnerability is actively exploited in the wild; immediately update Adobe Acrobat Reader to the latest version to secure your endpoints.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

CVE-2026-34621 is an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution', CWE-1321) vulnerability within the JavaScript engine of Adobe Acrobat Reader.

By leveraging malicious JavaScript embedded inside a PDF document, an attacker can pollute the base Object.prototype. This allows the attacker to inject or override properties of objects used internally by the application, leading to control flow hijacking and ultimately executing arbitrary code within the context of the logged-in user.

This vulnerability is actively exploited in the wild and is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog with an EPSS score of 0.94, indicating an extremely high risk of exploitation.

Official Vendor Advisories & References

NVD Original English Description

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

https://helpx.adobe.com/security/products/acrobat/apsb26-43.html

Source: psirt@adobe.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: