{"id":"adobe-reader-pdf-zero-day-apr-2026","category":"patch","status":"closed","title":"Adobe Acrobat and Reader fix malicious-PDF zero-day CVE-2026-34621","tldr":"Attackers used malicious PDFs to collect computer information and steal local file data through Adobe Reader. Adobe fixed CVE-2026-34621 across affected Windows and Mac products. Open Acrobat or Reader and choose Help > Check for Updates.","summary":"CVE-2026-34621 affects Adobe Acrobat and Reader on Windows and macOS. Opening a malicious PDF can let an attacker run their own code. EXPMON publicly disclosed the attacks on 7 April after analysing a PDF that collected computer details and could steal files accessible to Reader’s sandboxed process. A related sample had been submitted to VirusTotal on 28 November 2025. EXPMON did not obtain the suspected follow-on exploit from the attacker’s server during testing, so that part of the observed attack remained unconfirmed. Help Net Security reported that the PDFs displayed Russian-language gas-supply and emergency-response decoys; this does not establish who was compromised. Adobe confirmed active exploitation and released fixes for every affected supported product listed in its advisory on 11 April. CISA added the flaw to its exploited-vulnerability catalogue on 13 April. Whether the campaign remains active is not established.","action":"In Adobe Acrobat or Reader, choose Help > Check for Updates and install the latest release. The minimum fixed versions are 26.001.21411 for Acrobat DC and Reader DC, or Acrobat 2024 version 24.001.30362 on Windows and 24.001.30360 on Mac. Ask your IT team to update work-managed computers.","product":"Adobe Acrobat and Acrobat Reader for Windows and macOS","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-34621"],"tags":["adobe","acrobat","reader","windows","macos","zero-day","pdf"],"affected":["Acrobat DC, Continuous track: 26.001.21367 and earlier, Windows and macOS","Acrobat Reader DC, Continuous track: 26.001.21367 and earlier, Windows and macOS","Acrobat 2024, Classic 2024 track: 24.001.30356 and earlier, Windows and macOS"],"fixed":["Acrobat DC, Continuous track: 26.001.21411, Windows and macOS","Acrobat Reader DC, Continuous track: 26.001.21411, Windows and macOS","Acrobat 2024, Classic 2024 track: 24.001.30362, Windows","Acrobat 2024, Classic 2024 track: 24.001.30360, macOS"],"matches":[{"platform":"windows","app":"Adobe Acrobat DC","bundle":"","fixed":"26.001.21411"},{"platform":"macos","app":"Adobe Acrobat DC","bundle":"","fixed":"26.001.21411"},{"platform":"windows","app":"Adobe Acrobat Reader DC","bundle":"","fixed":"26.001.21411"},{"platform":"macos","app":"Adobe Acrobat Reader DC","bundle":"","fixed":"26.001.21411"},{"platform":"windows","app":"Adobe Acrobat 2024","bundle":"","fixed":"24.001.30362"},{"platform":"macos","app":"Adobe Acrobat 2024","bundle":"","fixed":"24.001.30360"}],"sources":[{"kind":"advisory","title":"Security update available for Adobe Acrobat Reader | APSB26-43","url":"https://www.adobe.com/trust/security/products/acrobat/apsb26-43.html","by":"Adobe","date":"2026-04-12"},{"kind":"research","title":"EXPMON detected sophisticated zero-day fingerprinting attack targeting Adobe Reader users","url":"https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html","by":"Haifei Li / EXPMON","date":"2026-04-07"},{"kind":"news","title":"Acrobat Reader zero-day exploited in the wild for many months (CVE-2026-34621)","url":"https://www.helpnetsecurity.com/2026/04/09/acrobat-reader-zero-day-exploited/","by":"Help Net Security","date":"2026-04-09"},{"kind":"news","title":"Adobe rolls out emergency fix for Acrobat, Reader zero-day flaw","url":"https://www.bleepingcomputer.com/news/security/adobe-rolls-out-emergency-fix-for-acrobat-reader-zero-day-flaw/","by":"BleepingComputer","date":"2026-04-13"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue: CVE-2026-34621","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-04-13"}],"started":"2026-04-07","closed":"2026-04-13","created":"2026-11-03T21:30:12.131Z","updated":"2026-11-03T21:30:12.131Z","cve_notes":[{"cve":"CVE-2026-34621","name":"Prototype pollution in Adobe Acrobat and Reader","what":"A prototype pollution flaw in Adobe Acrobat and Reader lets a malicious PDF alter internal object properties and potentially run an attacker’s code when opened.","severity":"critical","cvss":8.6}],"timeline":[{"at":"2026-04-13","added":"2026-11-03T21:25:43.261Z","kind":"cisa-added","text":"CISA added CVE-2026-34621 to its Known Exploited Vulnerabilities catalogue, with a 27 April remediation deadline for US federal civilian agencies.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-04-12","added":"2026-11-03T21:25:43.261Z","kind":"vendor-revised","text":"Adobe corrected the CVSS score from 9.6 to 8.6 because exploitation requires opening a local file. Adobe retained its critical severity rating.","url":"https://www.adobe.com/trust/security/products/acrobat/apsb26-43.html","by":"Adobe","patch":null},{"at":"2026-04-11","added":"2026-11-03T21:25:43.261Z","kind":"new-fix","text":"Adobe released priority-one fixes for Acrobat DC, Acrobat Reader DC and Acrobat 2024 on Windows and macOS, confirming active exploitation of CVE-2026-34621.","url":"https://www.adobe.com/trust/security/products/acrobat/apsb26-43.html","by":"Adobe","patch":"patched"},{"at":"2026-04-07","added":"2026-11-03T21:25:43.261Z","kind":"disclosed","text":"EXPMON disclosed that opening the PDF could collect computer information and steal files accessible to Reader’s sandboxed process. Its tests worked against the then-current Reader release; no fix was available.","url":"https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html","by":"Haifei Li / EXPMON","patch":"none"},{"at":"2026-03-26","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"An unidentified person submitted a suspicious PDF to EXPMON. Its detection system flagged the file for investigation.","url":"https://www.bleepingcomputer.com/news/security/adobe-rolls-out-emergency-fix-for-acrobat-reader-zero-day-flaw/","by":"BleepingComputer","patch":null},{"at":"2025-11-28","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"A malicious PDF variant was submitted to VirusTotal on this date, according to EXPMON’s subsequent investigation. This establishes that a sample existed months before public disclosure.","url":"https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html","by":"Haifei Li / EXPMON","patch":null}],"url":"https://hard.fyi/live/adobe-reader-pdf-zero-day-apr-2026/","json":"https://hard.fyi/api/live?id=adobe-reader-pdf-zero-day-apr-2026"}