CVE-2026-34621KEV · OVERDUECWE-1321

Adobe Acrobat and Reader Prototype Pollution Vulnerability

High · published April 11, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.6. It is confirmed in active exploitation. It sits in the 82.2th percentile for exploit probability.

180

days past CISA
deadline

CVSS v3.1

8.6

EPSS

Percentile

82.2

In the wild

Confirmed

What it is

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

The record

Technical detail

CVSS v3.1: 8.6 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.02183 · 82.2th percentile
Weakness: CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published: 2026-04-11T11:16Z
KEV added: 2026-04-13 · due 2026-04-27

Affected products (4)

Product	Versions	Fixed in
adobe/acrobat_dc	< 26.001.21411	26.001.21411
adobe/acrobat_reader_dc	< 26.001.21411	26.001.21411
adobe/acrobat	≥ 24.0.0, < 24.001.30362	24.001.30362
adobe/acrobat	≥ 24.0.0, < 24.001.30360	24.001.30360

References (2)

https://helpx.adobe.com/security/products/acrobat/apsb26-43.html · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

13 APR 00:00Z
Added to CISA KEV — remediate by Apr 27
kev
11 APR 06:45Z
Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
cvelistv5