Adobe Acrobat and Reader fix malicious-PDF zero-day CVE-2026-34621
Attackers used malicious PDFs to collect computer information and steal local file data through Adobe Reader. Adobe fixed CVE-2026-34621 across affected Windows and Mac products. Open Acrobat or Reader and choose Help > Check for Updates.
In Adobe Acrobat or Reader, choose Help > Check for Updates and install the latest release. The minimum fixed versions are 26.001.21411 for Acrobat DC and Reader DC, or Acrobat 2024 version 24.001.30362 on Windows and 24.001.30360 on Mac. Ask your IT team to update work-managed computers.
- Adobe Acrobat DCfixed in 26.001.21411 and later
- Adobe Acrobat DCfixed in 26.001.21411 and later
- Adobe Acrobat Reader DCfixed in 26.001.21411 and later
- Adobe Acrobat Reader DCfixed in 26.001.21411 and later
- Adobe Acrobat 2024fixed in 24.001.30362 and later
- Adobe Acrobat 2024fixed in 24.001.30360 and later
What’s happening
CVE-2026-34621 affects Adobe Acrobat and Reader on Windows and macOS. Opening a malicious PDF can let an attacker run their own code. EXPMON publicly disclosed the attacks on 7 April after analysing a PDF that collected computer details and could steal files accessible to Reader’s sandboxed process. A related sample had been submitted to VirusTotal on 28 November 2025. EXPMON did not obtain the suspected follow-on exploit from the attacker’s server during testing, so that part of the observed attack remained unconfirmed. Help Net Security reported that the PDFs displayed Russian-language gas-supply and emergency-response decoys; this does not establish who was compromised. Adobe confirmed active exploitation and released fixes for every affected supported product listed in its advisory on 11 April. CISA added the flaw to its exploited-vulnerability catalogue on 13 April. Whether the campaign remains active is not established.
- What
- Flaw
- Affects
- Adobe Acrobat and Acrobat Reader for Windows and macOS
- Affected
- Acrobat DC, Continuous track: 26.001.21367 and earlier, Windows and macOS
Acrobat Reader DC, Continuous track: 26.001.21367 and earlier, Windows and macOS
Acrobat 2024, Classic 2024 track: 24.001.30356 and earlier, Windows and macOS - Fixed in
- Acrobat DC, Continuous track: 26.001.21411, Windows and macOS
Acrobat Reader DC, Continuous track: 26.001.21411, Windows and macOS
Acrobat 2024, Classic 2024 track: 24.001.30362, Windows
Acrobat 2024, Classic 2024 track: 24.001.30360, macOS - Since
- 7 Apr 2026
- Closed
- 13 Apr 2026
Timeline
- CISA added
CISA added CVE-2026-34621 to its Known Exploited Vulnerabilities catalogue, with a 27 April remediation deadline for US federal civilian agencies.
- Vendor revised
Adobe corrected the CVSS score from 9.6 to 8.6 because exploitation requires opening a local file. Adobe retained its critical severity rating.
- New fixFixed
Adobe released priority-one fixes for Acrobat DC, Acrobat Reader DC and Acrobat 2024 on Windows and macOS, confirming active exploitation of CVE-2026-34621.
- Made publicNo fix yet
EXPMON disclosed that opening the PDF could collect computer information and steal files accessible to Reader’s sandboxed process. Its tests worked against the then-current Reader release; no fix was available.
- Update
An unidentified person submitted a suspicious PDF to EXPMON. Its detection system flagged the file for investigation.
- Update
A malicious PDF variant was submitted to VirusTotal on this date, according to EXPMON’s subsequent investigation. This establishes that a sample existed months before public disclosure.
Sources
- Security update available for Adobe Acrobat Reader | APSB26-43Adobe · 12 Apr 2026
- EXPMON detected sophisticated zero-day fingerprinting attack targeting Adobe Reader usersHaifei Li / EXPMON · 7 Apr 2026
- Acrobat Reader zero-day exploited in the wild for many months (CVE-2026-34621)Help Net Security · 9 Apr 2026
- Adobe rolls out emergency fix for Acrobat, Reader zero-day flawBleepingComputer · 13 Apr 2026
- Known Exploited Vulnerabilities catalogue: CVE-2026-34621CISA · 13 Apr 2026