Adobe has released a security bulletin (APSB26-43) regarding a severe vulnerability, CVE-2026-34621, affecting Adobe Acrobat and Reader. This vulnerability is of particular concern to security teams because it is currently being exploited in the wild, allowing attackers to execute arbitrary code on affected Windows and macOS systems.
Severity: High
Vulnerability Overview
- CVE ID: CVE-2026-34621
- Vulnerability Type: Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) (CWE-1321)
- CVSS Score: 8.6 (revised down from 9.6)
- Exploitation Status: Actively exploited in the wild since at least November
- Impact: Arbitrary Code Execution
- Affected Products and Versions:
The vulnerability impacts both Windows and macOS platforms for the following versions:
| Product | Track | Affected Versions | Fixed Versions |
| Acrobat DC | Continuous | 26.001.21367 and earlier | 26.001.21411 |
| Acrobat Reader DC | Continuous | 26.001.21367 and earlier | 26.001.21411 |
| Acrobat 2024 | Classic 2024 | 24.001.30356 and earlier | Windows: 24.001.30362 | Mac: 24.001.30360 |
Attack Chain
- Victim opens malicious PDF
- Obfuscated JavaScript executes (base64-encoded payload hidden in a form field object)
- Local system fingerprinting: language settings, reader version, exact OS version (parsed from ntdll.dll), local PDF file path
- Data exfiltrated to C2 via RSS.addFeed() call
- C2 evaluates victim profile; if criteria met, returns encrypted (AES-CTR), compressed follow-on JavaScript payload for RCE/SBX
Recommendations
- Adobe recommends users update their Acrobat Reader installations to the latest fixed versions.
- Exercise caution with PDFs from untrusted sources.
- Monitor and consider blocking outbound HTTP/HTTPS traffic where the User Agent is set to “Adobe Synchronizer”. This string is a key indicator of the exfiltration method used by this exploit.
- If business workflows permit, disable JavaScript in Adobe Reader entirely (Edit > Preferences > JavaScript > Uncheck ‘Enable Acrobat JavaScript’). This effectively kills the primary execution engine for this exploit.
- Conduct a retro-hunt across mail gateways and file shares for the filename yummy_adobe_exploit_uwu.pdf or similar variants.
- Block the IOCs at their respective controls
IOCS
https://www.virustotal.com/gui/collection/1c6b8b94b3ad32fc76dc34f7daf614ac56762c703526ec06f82e0420074192a0/iocs
Source:
- https://helpx.adobe.com/security/products/acrobat/apsb26-43.html
- https://www.ampcuscyber.com/shadowopsintel/zero-day-bug-in-acrobat-reader-actively-exploited-in-the-wild/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.