Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621
Summary: Adobe released emergency updates for a critical prototype pollution flaw in Acrobat Reader, CVE-2026-34621, carrying a CVSS score of 8.6 out of 10.0 that could allow an attacker to run malicious code, and Adobe acknowledged it is aware of the flaw being exploited in the wild. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on April 13, 2026, requiring Federal Civilian Executive Branch agencies to apply fixes by April 27, 2026, and there is evidence suggesting exploitation since December 2025.
What you should know: The flaw was reportedly exploited in the wild for roughly four months before Adobe's emergency fix, and CISA's April 27, 2026 deadline gives federal agencies a narrow window to patch a bug that runs code when a crafted PDF is opened.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-34621
- Related
- ⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More Cyber Risks ·CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability Known Exploited Vulnerabilities · Apr 13, 2026