Adobe has released an emergency security update to address a critical zero-day vulnerability in Acrobat and Reader for Windows and macOS.
According to Adobe’s APSB26-43 bulletin, the flaw is currently being exploited in the wild, prompting a Priority 1 rating from the company.
Designated as CVE-2026-34621, this vulnerability is an Improperly Controlled Modification of Object Prototype Attributes, commonly known as a Prototype Pollution flaw (CWE-1321).
Based on details from the GitHub Advisory Database, this weakness occurs when an application receives upstream input that specifies attributes to be initialized in an object, but fails to control modifications to the core prototype.
If successfully exploited, this chain of events can lead to arbitrary code execution within the context of the current user.
To trigger this exploit, threat actors must rely on user interaction. The victim is required to open a specially crafted, malicious PDF file.
While initially scored as a 9.6 with a Network attack vector, Adobe revised the CVSS base score to 8.6 on April 12, 2026, officially changing the attack vector to Local (AV:L).
As reported by EXPMON founder Haifei Li, who received official credit for discovering the vulnerability, this flaw allows attackers to execute malicious JavaScript embedded directly inside the compromised PDF document.
Threat intelligence indicates this zero-day vulnerability may have been leveraged in ongoing attacks since late 2025.
Users and organizations running the following software builds are currently exposed to this high-severity threat:
Given the confirmed active exploitation of this zero-day bug, organizations should prioritize patching immediately. Adobe recommends the following immediate mitigation strategies to secure environments.
End users should manually update their software installations by navigating to “Help > Check for Updates”.
Systems with automatic updates enabled will receive the critical patch without requiring user intervention. Users can also download the full installer directly from the official Acrobat Reader Download Center.
For IT administrators managing large-scale enterprise environments, Adobe advises deploying the updated installers via standard deployment methodologies.
For Windows networks, administrators should push the update using AIP-GPO, a bootstrapper, or SCUP/SCCM. For macOS environments, updates should be distributed using Apple Remote Desktop and SSH.
The fully patched versions that resolve this flaw are 26.001.21411 for the Continuous Track, 24.001.30362 for Acrobat 2024 on Windows, and 24.001.30360 for Acrobat 2024 on macOS.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…