Cybersecurity — 2026-04-13
Adobe Issues Emergency Patch for Actively Exploited Acrobat Reader Zero-Day
Adobe released emergency updates for a critical Acrobat Reader vulnerability (CVE-2026-34621, CVSS 8.6) under active exploitation since at least December 2025. The prototype pollution flaw allows arbitrary code execution via crafted PDFs that run privileged JavaScript APIs. Exploits use util.readFileIntoStream() to steal local files and RSS.addFeed() to exfiltrate data. Adobe classified the patch under bulletin APSB26-43 with priority 1, the highest urgency level. Researcher
Analysis
Exploitation since December 2025 means this zero-day was in the wild for four months before Adobe's emergency patch, a window during which any organization receiving PDFs from untrusted sources was exposed. The exploit chain is sophisticated: prototype pollution triggers privileged JavaScript execution, readFileIntoStream() exfiltrates local files, and addFeed() provides a C2 channel via RSS. The CVSS 8.6 and CISA priority 1 designation reflect both technical severity and confirmed active exploitation. PDF-based initial access remains a persistent blind spot for organizations that treat document formats as benign.
Exploitation since December 2025 means this zero-day was in the wild for four months before Adobe's emergency patch, a window during which any organization receiving PDFs from untrusted sources was exposed. The exploit chain is sophisticated: prototype pollution triggers privileged JavaScript execution, readFileIntoStream() exfiltrates local files, and addFeed() provides a C2 channel via RSS. The CVSS 8.6 and CISA priority 1 designation reflect both technical severity and confirmed active exploitation. PDF-based initial access remains a persistent blind spot for organizations that treat document formats as benign.
2 sources
- Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 -
The Hacker News - Adobe fixes actively exploited Acrobat Reader flaw CVE-2026-34621 -
Security Affairs