CYBERSECURITYApril 12, 20261 min read14 views

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621

Adobe has released emergency updates to fix a critical security flaw (CVE-2026-34621) in Acrobat Reader that is being actively exploited to execute malicious code.

Adobe has released emergency updates to fix a critical security flaw in Acrobat Reader that has come under active exploitation in the wild.

The vulnerability, assigned the CVE identifier CVE-2026-34621, carries a CVSS score of 8.6 out of 10.0. Successful exploitation of the flaw could allow an attacker to run malicious code on affected installations.

It has been described as a case of prototype pollution that could result in arbitrary code execution. Prototype pollution refers to a JavaScript security vulnerability that permits an attacker to manipulate an application'sobjects and properties.

The issue impacts the following products and versions for both Windows and macOS -

Acrobat DC versions 26.001.21367 and earlier (Fixed in 26.001.21411)
Acrobat Reader DC versions 26.001.21367 and earlier (Fixed in 26.001.21411)
Acrobat 2024 versions 24.001.30356 and earlier (Fixed in 24.001.30362 for Windows and 24.001.30360 for macOS)

Adobe acknowledged that it's "aware of CVE-2026-34621 being exploited in the wild."

The development comes days after security researcher and EXPMON founder Haifei Li disclosed details of zero-day exploitation of the flaw to run malicious JavaScript code when opening specially crafted PDF documents through Adobe Reader. There is evidence suggesting that the vulnerability may have been under exploitation since December 2025.

"It appears that Adobe has determined the bug can lead to arbitrary code execution — not just an information leak," EXPMON said in a post on X. "This aligns with our findings and those of other security researchers over the last few days."

(The story was updated after publication to reflect the change in CVSS score from 9.6 to 8.6. In a revision to its advisory on April 12, 2026, Adobe said it adjusted the attack vector from Network (AV:N) to Local (AV:L).)

Source: The Hacker News

More in this category

cybersecurity

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have uncovered a massive campaign named FakeGit, leveraging thousands of malicious GitHub repositories to distribute SmartLoader malware. The campaign features a novel technique called AgentBaiting, which tricks AI agents into executing malicious instructions autonomously.

cybersecurity

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

A mere 11-byte TLS request can force an unpatched OpenSSL server to allocate up to 131 KB of memory that is never released. OpenSSL silently patched this "HollowByte" vulnerability without issuing a CVE or security advisory.

cybersecurity

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack.

cybersecurity

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

Cybersecurity researchers have attributed the April 2026 DigiCert security incident to CylindricalCanine, a subgroup of the Chinese cybercrime group GoldenEyeDog, which compromised DigiCert's support portal to steal and abuse code-signing certificates.

cybersecurity

Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man

Armenia has detained a Russian tourist on a U.S. extradition warrant targeting a REvil ransomware suspect. However, defense lawyers argue it is a case of mistaken identity caused by incomplete name details in the U.S. warrant.

cybersecurity

ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

ACR Stealer, an active infostealer, is targeting enterprise networks using sophisticated 'ClickFix' social engineering lures. By tricking users into pasting malicious commands into the Run dialog, attackers can easily steal session tokens, browser credentials, and sensitive documents from OneDrive and SharePoint.