Adobe Acrobat CVE-2020-9715: 2020 Use-After-Free in KEV
Patched in August 2020 with a public exploit write-up since 2021; the KEV listing matters only where Acrobat or Reader is years out of date, which is most likely on end-of-life Classic installs and frozen images.
Must act: Organizations with Acrobat or Reader installs that do not auto-update, especially the old Classic 2015, 2017 and 2020 tracks, VDI or kiosk images, and machines where updates were disabled.
Can relax: Users of Acrobat or Reader DC on the Continuous track that has auto-updated since August 2020, and anyone already current with Adobe's 2026 bulletins.
- Inventory Acrobat and Reader versions on Windows and macOS endpoints and in VDI, kiosk and server images.
- Update the Continuous track to the current release with Help > Check for Updates or your deployment tool; anything at or above APSB26-43 (26.001.21411) also covers the April 2026 zero-day.
- Replace Classic 2017 and 2020 installs, which no longer receive security updates, and any older Classic 2015 installs with a supported release.