CVE-2026-34621

Description

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Scoring

• CVSS: 8.6 (HIGH, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2026-04-13
• Remediation due date: 2026-04-27
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-1321

References

• https://helpx.adobe.com/security/products/acrobat/apsb26-43.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621

More from Adobe

• CVE-2026-48356 — Commerce and Magento
• CVE-2026-71362 — Commerce and Magento
• CVE-2026-75650 — Commerce and Magento
• CVE-2026-48282 — ColdFusion
• CVE-2009-3459 — Acrobat and Reader