ZeroDay Findings
Sign inSign up

Findings

CVE-2026-34621

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Published Apr 11, 2026 · updated Aug 27, 2026 · Adobe Acrobat and Reader

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 11, 2026 · Catalog

    Detected

    Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

  2. Apr 13, 2026 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Apr 27, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Aug 27, 2026 · Catalog

    Updated

    Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Apr 27, 2026

Affected

  • cpe adobe/acrobatversion unspecified
  • cpe adobe/acrobat dcversion unspecified
  • cpe adobe/acrobat reader dcversion unspecified
  • vendor Adobe Acrobat and Readerversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2026-34621

    Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2026-34621

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-34621

    30-day exploitation probability 2.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-34621

    Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation

    nvd.nist.gov

References