Actively exploited · Published Apr 11, 2026 · Assigned by adobe
CVE-2026-34621Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
High 8.6 Exploited
In plain English
A high-severity prototype pollution in Acrobat 2024 from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on April 13, 2026). The chance it is exploited in the next 30 days is estimated at 7.2% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Apr 27, 2026.
Official description
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Acrobat DC | 0 – through 26.001.21367 |
| Adobe | Acrobat Reader DC | 0 – through 26.001.21367 |
| Adobe | Acrobat 2024 | 0 – through 24.001.30356 |
Weakness: CWE-1321 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H