VULNERABILITY 🔴 1×KEV
CVE-2026-34621 in Adobe Acrobat and Reader: Actively Exploited Zero-Day (KEV)
- A critical Remote Code Execution (RCE) vulnerability, CVE-2026-34621, affects Adobe Acrobat and Reader.
- CONFIRMED exploitation in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on 2026-04-13.
- An emergency patch is available from Adobe and must be applied immediately to all affected systems.
Technical Analysis
CVE-2026-34621 is a critical Remote Code Execution (RCE) vulnerability in Adobe Acrobat and Reader. Public technical details on the specific vulnerability class are not yet available. However, the CVSS score of 9.6 indicates a low-complexity attack vector that likely requires minimal user interaction, such as opening a specially crafted PDF document. Successful exploitation allows an attacker to execute arbitrary code on the victim's system, potentially with the privileges of the logged-in user.
The attack chain is initiated when a user opens a malicious PDF file. The exploit triggers the underlying vulnerability within the PDF parsing engine, leading to code execution. This type of vulnerability is common in complex file format parsers and often involves memory corruption bugs. The high impact and low complexity ratings suggest that the exploit does not require special configurations or authenticated access to the target system.
Affected Systems
- Adobe Acrobat
- Adobe Reader
Intelligence Context
The primary driver for immediate action is the CONFIRMED evidence of active exploitation, as documented by its addition to the CISA KEV catalog on 2026-04-13. This designation overrides other metrics. Notably, the EPSS score is exceptionally low (0.00038), which would normally suggest a low probability of exploitation. This discrepancy is characteristic of a zero-day exploit used in targeted attacks before its discovery and public disclosure. Statistical models like EPSS require time and data to adjust to new threats, making the KEV catalog the authoritative source for prioritization in this case. The 'ZERO-DAY RACE' label accurately reflects the situation: defenders are responding to an exploit that was already in use by threat actors.
Remediation & Defense
- No workarounds have been published. Patching is the only specified mitigation.
- Monitor for suspicious child processes spawned by Acrobat.exe or AcroRd32.exe, such as cmd.exe or powershell.exe.
- Use endpoint detection and response (EDR) tools to look for anomalous behavior from Adobe processes following the opening of a PDF document.
Source Timeline
- portal.auscert.org.au — First reporter
- bleepingcomputer.com — Public confirmation of patch
- cisa.gov/kev — Official exploitation confirmation
- cert.ssi.gouv.fr — Corroborating advisory
- hkcert.org — Corroborating advisory