erroneo.us
Search all guides⌘K

Digest · Saturday

Security digest: April 11, 2026

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Acrobat Reader CVE-2026-34621: Exploited JavaScript Zero-Day. Organizations with Acrobat or Reader installs that do not auto-update, Classic 2024 installs pinned to old builds, VDI or kiosk images, and any Acrobat 2020 or older Classic install.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2026-34621

Acrobat Reader CVE-2026-34621: Exploited JavaScript Zero-Day

Adobe fixed this targeted zero-day in April 2026 and the Continuous track updates itself; confirm no install is still below the fixed builds, and hunt for the published indicators if your users fit the lure profile.

Must act: Organizations with Acrobat or Reader installs that do not auto-update, Classic 2024 installs pinned to old builds, VDI or kiosk images, and any Acrobat 2020 or older Classic install.

Can relax: Users of Acrobat or Reader on the Continuous track that has auto-updated since April 2026, and Classic 2024 installs at 24.001.30362 (Windows) or 24.001.30360 (macOS) or later.

  1. Inventory Acrobat and Reader versions on Windows and macOS endpoints and in VDI, kiosk and server images.
  2. Update Continuous installs to 26.001.21411 or later and Classic 2024 to 24.001.30362 (Windows) or 24.001.30360 (macOS) or later.
  3. Replace Acrobat 2020 and older Classic installs with a supported release.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.