CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
Overview
Adobe Acrobat and Reader contain a prototype pollution flaw that allows a crafted file to corrupt the JavaScript engine's shared object prototypes, ultimately executing arbitrary code under the victim's account. The vulnerability affects Acrobat DC and Acrobat Reader DC through version 26.001.21367, and Acrobat 2024 through version 24.001.30356, on both Windows and macOS. Adobe has confirmed active exploitation in the wild.
Vulnerability details
Prototype pollution (CWE-1321) occurs when an application processes attacker-controlled property keys without sanitizing reserved identifiers such as __proto__ or constructor.prototype. In Acrobat and Reader, the embedded JavaScript engine processes object properties from within a malicious file. Because the engine does not properly validate these keys before assignment, an attacker can inject properties onto the root prototype chain, causing all objects that inherit from it to carry attacker-defined values. This corrupts program logic in ways that can redirect execution flow.
An attacker delivers a specially crafted file containing JavaScript or data structures designed to trigger the prototype pollution when the file is opened. The victim must open the file; the delivery vector is not specified in the advisory. Once opened, the malicious property assignments propagate through the prototype chain and achieve arbitrary code execution in the context of the current user. The changed scope metric in the CVSS assessment may reflect a sandbox escape, though the facts do not explicitly confirm this. Adobe rates this vulnerability as Priority 1 and has confirmed it is being exploited in the wild.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor endpoint security telemetry for Acrobat or Reader processes spawning unexpected child processes (shells, script interpreters, or network-connected binaries) immediately after a PDF or supported file is opened, as this pattern is inconsistent with normal document rendering.
- Review email gateway and web proxy logs for delivery of files to users running affected Acrobat versions, particularly files arriving from external sources shortly before any anomalous Acrobat process behavior is observed.
Remediation
Additional hardening
- Update Acrobat DC and Acrobat Reader DC to version 26.001.21411 or later, and Acrobat 2024 to 24.001.30362 on Windows or 24.001.30360 on macOS; see the vendor advisory in References for full details on all affected tracks.
- Disable JavaScript execution in Acrobat and Reader via Edit > Preferences > JavaScript by unchecking 'Enable Acrobat JavaScript'; this removes the primary attack surface for prototype pollution exploits delivered through malicious files.
- Configure email gateways and web proxies to sandbox or quarantine PDF and Office-format files from untrusted external sources before delivery to end users, reducing the likelihood that a crafted file reaches an unpatched installation.
- Apply application allowlisting or endpoint controls to prevent Acrobat and Reader processes from spawning child processes or making outbound network connections, limiting the impact of a successful exploitation attempt.
Key dates
References
Frequently asked questions
Does CVE-2026-34621 affect my FedRAMP authorization?
If Adobe Acrobat and Reader runs inside your authorization boundary, yes. CVE-2026-34621 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of April 27, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in your boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can already see. Your options now are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-34621?
Knox does not patch your software. Remediating Adobe Acrobat and Reader is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage that help you document the fix for your next assessment. The remediation work is yours to carry out; maintaining a defensible compliance posture while you carry it out is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including cases like CVE-2026-34621. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you a narrower window between disclosure and documented response.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-34621's remediation deadline of April 27, 2026 has passed. What happens now?
If CVE-2026-34621 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
