erroneo.us
Search all guides⌘K

Security Digest · Apr 11, 2026 · Vulnerability · Other

Acrobat Reader CVE-2026-34621: Exploited JavaScript Zero-Day

Acrobat and Reader prototype pollution zero-day used since at least Nov 2025, fixed Apr 11, 2026 in 26.001.21411 and Classic 2024. Confirm builds and hunt.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Check exposure

Adobe fixed this targeted zero-day in April 2026 and the Continuous track updates itself; confirm no install is still below the fixed builds, and hunt for the published indicators if your users fit the lure profile.

Who must act: Organizations with Acrobat or Reader installs that do not auto-update, Classic 2024 installs pinned to old builds, VDI or kiosk images, and any Acrobat 2020 or older Classic install.

Who can relax: Users of Acrobat or Reader on the Continuous track that has auto-updated since April 2026, and Classic 2024 installs at 24.001.30362 (Windows) or 24.001.30360 (macOS) or later.

Affected
Acrobat DC and Acrobat Reader DC (Continuous) 26.001.21367 and earlier
Acrobat 2024 (Classic 2024) 24.001.30356 and earlier
Acrobat 2020 and older Classic tracks are out of support and not listed in the bulletin
Fixed in
Acrobat DC and Acrobat Reader DC 26.001.21411
Acrobat 2024: 24.001.30362 (Windows) and 24.001.30360 (macOS)
No fix for Acrobat 2020, which reached end of support on November 30, 2025; replace it
CVSS
8.6 (v3.1, vendor)
EPSS
2.2% (percentile 82)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory Acrobat and Reader versions on Windows and macOS endpoints and in VDI, kiosk and server images.
  2. Update Continuous installs to 26.001.21411 or later and Classic 2024 to 24.001.30362 (Windows) or 24.001.30360 (macOS) or later.
  3. Replace Acrobat 2020 and older Classic installs with a supported release.
  4. Where workflows allow, turn off Acrobat JavaScript, which this exploit relies on.
  5. Alert on or block outbound HTTP(S) whose User-Agent contains Adobe Synchronizer, as the discoverer recommends, and block the two published attacker IPs.

How to check if you are affected or compromised

  • Search proxy logs from November 2025 onward for traffic to 169.40.2.68 or 188.214.34.20, the servers in the two known samples.
  • Search mail and file stores for SHA-256 65dca34b04416f9a113f09718cbe51e11fd58e7287b7863e37f393ed4d25dde7 and 54077a5b15638e354fa02318623775b7a1cc0e8c21e59bcbab333035369e377f.
  • Review EDR for AdobeCollabSync.exe making external connections, and for Acrobat.exe or AcroRd32.exe spawning shells or unsigned binaries.
  • Look in proxy logs for requests with Adobe Synchronizer in the User-Agent going to destinations that are not Adobe's.

What happened#

On April 7, 2026, researcher Haifei Li reported a malicious PDF that his EXPMON detection system had caught. The sample, yummy_adobe_exploit_uwu.pdf, was submitted to EXPMON on March 26 and had first appeared on VirusTotal on March 23. It still worked against the latest Reader, 26.001.21367. Opening it runs obfuscated JavaScript. The script calls the privileged RSS.addFeed() API to send the Reader language, Reader version, exact OS version and the PDF's local path to a remote server, and to fetch more JavaScript. It also calls util.readFileIntoStream() to read local files, such as ntdll.dll. Li never received a follow-on code execution or sandbox escape stage and called it "an advanced fingerprinting attack." On April 8, he added a variant first seen on VirusTotal on November 28, 2025.

Adobe released APSB26-43 on April 11 with Priority 1, stating that it "is aware of CVE-2026-34621 being exploited in the wild." It credits Li. The bug is prototype pollution (CWE-1321) that can lead to arbitrary code execution as the current user. Adobe first scored it CVSS 9.6, then on April 12 changed the attack vector to local, which gives 8.6. The CVE record and NVD carry the same 8.6. CISA added it to the KEV catalog on April 13, with an April 27 deadline.

Both samples showed Russian-language decoy pages about gas supply disruption and emergency response, according to an analysis reported by Help Net Security. That points to targeted attacks, but nobody has named the attacker as of Oct 23, 2026. CISA added the 2020 bug CVE-2020-9715 the same day. No public source links the two.

Who is affected#

Acrobat DC and Acrobat Reader DC 26.001.21367 and earlier, and Acrobat 2024 24.001.30356 and earlier, on Windows and macOS. The fixes are 26.001.21411, and 24.001.30362 (Windows) or 24.001.30360 (macOS). Acrobat 2020 is not in the bulletin. Adobe ended its support on November 30, 2025, so it gets no fix.

Do you really need to act?#

The fix is six months old and the Continuous track updates itself, so most users are covered. Exposure remains where updates are disabled, Classic 2024 is pinned to an old build, golden images are rarely rebuilt, or Acrobat 2020 still runs. Someone must open the PDF. The bigger question is the past. Exploitation ran from at least November 2025 to April 2026 with no patch available. If your users match the lure profile, run the hunt below even if you are patched now.

What to do now#

  1. Inventory versions. On Windows: Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Acrobat*' | Select-Object DisplayName, DisplayVersion. On macOS: mdls -name kMDItemVersion /Applications/Adobe\ Acrobat*.app.
  2. Update Continuous installs to 26.001.21411 or later, and Classic 2024 to the fixed builds or later.
  3. Replace Acrobat 2020 and anything older.
  4. Where workflows allow, turn off Acrobat JavaScript, which this exploit relies on.
  5. Follow Li's advice: alert on or block HTTP(S) traffic whose User-Agent contains Adobe Synchronizer, and block the two IPs below.

How to tell if you were hit#

Search proxy and firewall logs from November 2025 onward for 169.40.2.68 (port 45191) and 188.214.34.20 (port 34123). Search mail and file stores for the sample hashes 65dca34b04416f9a113f09718cbe51e11fd58e7287b7863e37f393ed4d25dde7 and 54077a5b15638e354fa02318623775b7a1cc0e8c21e59bcbab333035369e377f. Review EDR for AdobeCollabSync.exe connecting to unusual external hosts. Infrastructure changes, so a miss does not prove a clean history.

Timeline#

  • — A variant first appears on VirusTotal.
  • — The sample reaches EXPMON.
  • — Li publishes his analysis.
  • — Adobe releases APSB26-43.
  • — Adobe revises the CVSS score from 9.6 to 8.6.
  • — CISA adds the CVE to KEV.
  • — KEV remediation deadline.

Vulnerability records

  • CVE-2026-34621 · KEV 2026-04-13 · Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Adobe — APSB26-43: Security update available for Adobe Acrobat Reader (archived) web.archive.org
  2. Haifei Li (EXPMON) — EXPMON detected sophisticated zero-day fingerprinting attack targeting Adobe Reader users justhaifei1.blogspot.com
  3. CVE record — CVE-2026-34621 cve.org
  4. NVD — CVE-2026-34621 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2026-34621 cisa.gov
  6. Adobe — End of sale for Acrobat 2020 in TLP and CLP (archived) web.archive.org

Coverage and analysis

  1. Help Net Security — Acrobat Reader zero-day exploited in the wild for many months (CVE-2026-34621) helpnetsecurity.com