high8.6Known exploited
CVE-2026-34621
Adobe Acrobat and Reader Prototype Pollution Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-04-13. Federal due date: 2026-04-27.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adobe | Acrobat Dc | before 26.001.21411 |
| Adobe | Acrobat Reader Dc | before 26.001.21411 |
| Adobe | Acrobat | from 24.0.0 before 24.001.30362 from 24.0.0 before 24.001.30360 |