{"id":"CVE-2026-34621","published":"2026-04-11T07:16:03Z","modified":"2026-10-26T21:10:00Z","title":"Adobe Acrobat and Reader Prototype Pollution Vulnerability","vendor":"Adobe","product":"Acrobat and Reader","tier":"core","eol":null,"description":{"text":"Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","provenance":"source","from":"NVD"},"summary":{"text":"A prototype pollution flaw in Adobe Acrobat and Reader, which is caused by improperly controlled modification of object prototype attributes, lets malicious input alter object prototypes. An attacker who can get a victim to open a malicious file can achieve arbitrary code execution in the context of the current user, with no prior authentication required but user interaction necessary.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:41Z"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.0723,"percentile":0.94317,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-04-13","dueDate":"2026-04-27","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-04-07","exploitedFirstSeen":"2026-04-07","ransomware":false,"evidence":[{"url":"https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html","date":"2026-04-07"},{"url":"https://helpx.adobe.com/security/products/acrobat/apsb26-43.html","date":"2026-04-11"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2026-04-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-04-13"},{"url":"https://nefariousplan.com/posts/adobe-acrobat-cve-2026-34621-detection-lie","date":"2026-04-23"},{"url":"https://ti.qianxin.com/uploads/2026/10/29/20ab59a356a884498644cff73d47a13a.pdf","date":"2026-10-29"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"references":[{"url":"https://helpx.adobe.com/security/products/acrobat/apsb26-43.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: User opens malicious file","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"a victim must open a malicious file","start":329,"end":364}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Code execution in reader process","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could result in arbitrary code execution in the context of the current user","start":191,"end":266}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-21675","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21675","exploited":true,"exploitedSince":"2026-04-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2026-04-13","earliestUrl":"https://github.com/ercihan/CVE-2026-34621","repos":[{"name":"azefzafyoussef/CVE-2026-34621","url":"https://github.com/azefzafyoussef/CVE-2026-34621","stars":26,"created":"2026-05-12"},{"name":"NULL200OK/cve_2026_34621_advanced","url":"https://github.com/NULL200OK/cve_2026_34621_advanced","stars":13,"created":"2026-04-15"},{"name":"ercihan/CVE-2026-34621","url":"https://github.com/ercihan/CVE-2026-34621","stars":2,"created":"2026-04-13"},{"name":"ercihan/CVE-2026-34621_PDF_SAMPLE","url":"https://github.com/ercihan/CVE-2026-34621_PDF_SAMPLE","stars":2,"created":"2026-04-17"},{"name":"KeulenR01/Remediate-AdobeAcrobat-CVE-2026-34621","url":"https://github.com/KeulenR01/Remediate-AdobeAcrobat-CVE-2026-34621","stars":1,"created":"2026-04-14"}]},"first":{"date":"2026-04-13","source":"PoC-in-GitHub","url":"https://github.com/ercihan/CVE-2026-34621"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"}],"timeline":[{"date":"2026-04-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html","provenance":"source"},{"date":"2026-04-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34621","provenance":"source"},{"date":"2026-04-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ercihan/CVE-2026-34621","provenance":"source"},{"date":"2026-04-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-04-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21675","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2},"priority":{"score":72.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 207 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.86,"detail":"percentile 0.9432"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.02,"detail":"base score 8.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}