---
title: "Acrobat Reader CVE-2026-34621: Exploited JavaScript Zero-Day"
url: https://erroneo.us/security/briefs/adobe-acrobat-reader-cve-2026-34621-prototype-pollution/
description: "Acrobat and Reader prototype pollution zero-day used since at least Nov 2025, fixed Apr 11, 2026 in 26.001.21411 and Classic 2024. Confirm builds and hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-04-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-34621"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Acrobat Reader CVE-2026-34621: Exploited JavaScript Zero-Day

**Verdict: Check exposure.** Adobe fixed this targeted zero-day in April 2026 and the Continuous track updates itself; confirm no install is still below the fixed builds, and hunt for the published indicators if your users fit the lure profile.

- **Who must act:** Organizations with Acrobat or Reader installs that do not auto-update, Classic 2024 installs pinned to old builds, VDI or kiosk images, and any Acrobat 2020 or older Classic install.
- **Who can relax:** Users of Acrobat or Reader on the Continuous track that has auto-updated since April 2026, and Classic 2024 installs at 24.001.30362 (Windows) or 24.001.30360 (macOS) or later.
- **Affected:** Acrobat DC and Acrobat Reader DC (Continuous) 26.001.21367 and earlier; Acrobat 2024 (Classic 2024) 24.001.30356 and earlier; Acrobat 2020 and older Classic tracks are out of support and not listed in the bulletin
- **Fixed:** Acrobat DC and Acrobat Reader DC 26.001.21411; Acrobat 2024: 24.001.30362 (Windows) and 24.001.30360 (macOS); No fix for Acrobat 2020, which reached end of support on November 30, 2025; replace it
- **CVEs:** CVE-2026-34621
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory Acrobat and Reader versions on Windows and macOS endpoints and in VDI, kiosk and server images.
2. Update Continuous installs to 26.001.21411 or later and Classic 2024 to 24.001.30362 (Windows) or 24.001.30360 (macOS) or later.
3. Replace Acrobat 2020 and older Classic installs with a supported release.
4. Where workflows allow, turn off Acrobat JavaScript, which this exploit relies on.
5. Alert on or block outbound HTTP(S) whose User-Agent contains Adobe Synchronizer, as the discoverer recommends, and block the two published attacker IPs.

### How to check if you are affected

- Search proxy logs from November 2025 onward for traffic to 169.40.2.68 or 188.214.34.20, the servers in the two known samples.
- Search mail and file stores for SHA-256 65dca34b04416f9a113f09718cbe51e11fd58e7287b7863e37f393ed4d25dde7 and 54077a5b15638e354fa02318623775b7a1cc0e8c21e59bcbab333035369e377f.
- Review EDR for AdobeCollabSync.exe making external connections, and for Acrobat.exe or AcroRd32.exe spawning shells or unsigned binaries.
- Look in proxy logs for requests with Adobe Synchronizer in the User-Agent going to destinations that are not Adobe's.

## What happened

On April 7, 2026, researcher Haifei Li [reported](https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html) a malicious PDF that his EXPMON detection system had caught. The sample, `yummy_adobe_exploit_uwu.pdf`, was submitted to EXPMON on March 26 and had first appeared on VirusTotal on March 23. It still worked against the latest Reader, 26.001.21367. Opening it runs obfuscated JavaScript. The script calls the privileged `RSS.addFeed()` API to send the Reader language, Reader version, exact OS version and the PDF's local path to a remote server, and to fetch more JavaScript. It also calls `util.readFileIntoStream()` to read local files, such as `ntdll.dll`. Li never received a follow-on code execution or sandbox escape stage and called it "an advanced fingerprinting attack." On April 8, he added a variant first seen on VirusTotal on November 28, 2025.

Adobe released [APSB26-43](http://web.archive.org/web/20260917150235/https://helpx.adobe.com/security/products/acrobat/apsb26-43.html) on April 11 with Priority 1, stating that it "is aware of CVE-2026-34621 being exploited in the wild." It credits Li. The bug is prototype pollution (CWE-1321) that can lead to arbitrary code execution as the current user. Adobe first scored it CVSS 9.6, then on April 12 changed the attack vector to local, which gives 8.6. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-34621) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-34621) carry the same 8.6. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621) on April 13, with an April 27 deadline.

Both samples showed Russian-language decoy pages about gas supply disruption and emergency response, according to an analysis reported by [Help Net Security](https://www.helpnetsecurity.com/2026/04/09/acrobat-reader-zero-day-exploited/). That points to targeted attacks, but nobody has named the attacker as of Oct 23, 2026. CISA added the 2020 bug CVE-2020-9715 the same day. No public source links the two.

## Who is affected

Acrobat DC and Acrobat Reader DC 26.001.21367 and earlier, and Acrobat 2024 24.001.30356 and earlier, on Windows and macOS. The fixes are 26.001.21411, and 24.001.30362 (Windows) or 24.001.30360 (macOS). Acrobat 2020 is not in the bulletin. [Adobe ended its support](http://web.archive.org/web/20260826031003/https://helpx.adobe.com/acrobat/kb/acrobat-perpetual-eos.html) on November 30, 2025, so it gets no fix.

## Do you really need to act?

The fix is six months old and the Continuous track updates itself, so most users are covered. Exposure remains where updates are disabled, Classic 2024 is pinned to an old build, golden images are rarely rebuilt, or Acrobat 2020 still runs. Someone must open the PDF. The bigger question is the past. Exploitation ran from at least November 2025 to April 2026 with no patch available. If your users match the lure profile, run the hunt below even if you are patched now.

## What to do now

1. Inventory versions. On Windows: `Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Acrobat*' | Select-Object DisplayName, DisplayVersion`. On macOS: `mdls -name kMDItemVersion /Applications/Adobe\ Acrobat*.app`.
2. Update Continuous installs to 26.001.21411 or later, and Classic 2024 to the fixed builds or later.
3. Replace Acrobat 2020 and anything older.
4. Where workflows allow, turn off Acrobat JavaScript, which this exploit relies on.
5. Follow Li's advice: alert on or block HTTP(S) traffic whose User-Agent contains `Adobe Synchronizer`, and block the two IPs below.

## How to tell if you were hit

Search proxy and firewall logs from November 2025 onward for `169.40.2.68` (port 45191) and `188.214.34.20` (port 34123). Search mail and file stores for the sample hashes `65dca34b04416f9a113f09718cbe51e11fd58e7287b7863e37f393ed4d25dde7` and `54077a5b15638e354fa02318623775b7a1cc0e8c21e59bcbab333035369e377f`. Review EDR for `AdobeCollabSync.exe` connecting to unusual external hosts. Infrastructure changes, so a miss does not prove a clean history.

## Timeline

- Nov 28, 2025 — A variant first appears on VirusTotal.
- Mar 26, 2026 — The sample reaches EXPMON.
- Apr 7, 2026 — Li publishes his analysis.
- Apr 11, 2026 — Adobe releases APSB26-43.
- Apr 12, 2026 — Adobe revises the CVSS score from 9.6 to 8.6.
- Apr 13, 2026 — CISA adds the CVE to KEV.
- Apr 27, 2026 — KEV remediation deadline.

## Sources

1. [Adobe — APSB26-43: Security update available for Adobe Acrobat Reader (archived)](http://web.archive.org/web/20260917150235/https://helpx.adobe.com/security/products/acrobat/apsb26-43.html)
2. [Haifei Li (EXPMON) — EXPMON detected sophisticated zero-day fingerprinting attack targeting Adobe Reader users](https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html)
3. [CVE record — CVE-2026-34621](https://www.cve.org/CVERecord?id=CVE-2026-34621)
4. [NVD — CVE-2026-34621](https://nvd.nist.gov/vuln/detail/CVE-2026-34621)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-34621](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621)
6. [Adobe — End of sale for Acrobat 2020 in TLP and CLP (archived)](http://web.archive.org/web/20260826031003/https://helpx.adobe.com/acrobat/kb/acrobat-perpetual-eos.html)
7. [Help Net Security — Acrobat Reader zero-day exploited in the wild for many months (CVE-2026-34621)](https://www.helpnetsecurity.com/2026/04/09/acrobat-reader-zero-day-exploited/)

---
Source page: https://erroneo.us/security/briefs/adobe-acrobat-reader-cve-2026-34621-prototype-pollution/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt