CVE-2026-34621

What it actually does

This vulnerability is a prototype pollution flaw in Adobe Acrobat and Acrobat Reader. A malicious PDF can manipulate JavaScript object prototype attributes inside the Acrobat/Reader execution context, potentially corrupting application behavior and enabling arbitrary code execution as the user who opens the file. Because exploitation requires opening a crafted document, the attack is user-assisted, but no attacker authentication or elevated privileges are required. Successful exploitation can allow code execution with the current user’s permissions on Windows or macOS, enabling payload execution, data access, persistence attempts, and lateral movement depending on local privileges and endpoint controls.

Why it matters to the business

An attacker can use a malicious PDF to compromise employee workstations, which can lead to credential theft, malware installation, data exfiltration, or broader intrusion activity. The issue is listed in CISA KEV with a remediation due date of 2026-04-27 and has active in-the-wild exploitation, so organizations should treat unpatched Acrobat and Reader installations as high-priority exposure. Although the vulnerability is not currently identified as used in ransomware campaigns, document-based initial access is commonly used for phishing and targeted intrusion, making this a practical operational risk for organizations that frequently exchange PDFs.

How an attack unfolds

An attacker crafts a PDF containing malicious JavaScript or PDF structures that trigger improper modification of object prototype attributes when parsed or executed by Acrobat or Acrobat Reader. The attacker then delivers the file through email, messaging, compromised websites, file-sharing platforms, or other social engineering channels. When a victim opens the document in a vulnerable Acrobat or Reader version, the prototype pollution condition can alter expected object behavior inside the application and lead to arbitrary code execution. The payload then runs in the context of the current user, commonly followed by downloading a second-stage payload, spawning scripting or command-line tools, collecting credentials or documents, and establishing persistence. The presence of active exploitation and the BlueHammer threat-actor/campaign association increases the need to investigate suspicious PDF handling, Acrobat child processes, and post-exploitation activity.

How to fix it

Upgrade Adobe Acrobat and Adobe Acrobat Reader to vendor-fixed versions newer than Acrobat Reader 24.001.30356 and 26.001.21367, and newer than equivalent affected Acrobat DC/Reader DC releases. Because exact fixed versions were not provided in the input, use Adobe’s official security bulletin and enterprise update channels to confirm the current secure release for each supported track. Prioritize internet-facing, email-heavy, finance, legal, HR, executive, and high-risk user populations that commonly open externally supplied PDFs. If immediate patching is not possible, reduce exposure by disabling or restricting Acrobat JavaScript where operationally feasible, enforcing Protected View/Protected Mode, blocking PDFs from untrusted sources, detonating attachments in a sandbox, preventing Acrobat/Reader from spawning child processes through EDR or application control, and limiting outbound network access from PDF reader processes. Remove unsupported Acrobat/Reader versions and standardize managed update enforcement across Windows and macOS fleets.

How to confirm the fix worked

Confirm that all installed Acrobat and Acrobat Reader versions are newer than the affected versions listed in the advisory, specifically later than 24.001.30356 and 26.001.21367 for the impacted release tracks. Validate using endpoint inventory, software management tooling, Adobe Remote Update Manager, package management records, or direct application version checks. On Windows, verify installed versions from Programs and Features, enterprise inventory, or file metadata for Acrobat.exe and AcroRd32.exe. On macOS, verify application bundle versions for Adobe Acrobat.app or Acrobat Reader.app. Test mitigations by confirming Acrobat JavaScript, Protected View, child-process restrictions, attachment sandboxing, and EDR rules are applied as intended. Review a sample of endpoints that recently opened external PDFs to ensure no vulnerable versions remain and no suspicious Acrobat-spawned processes occurred before remediation.

Typical attack path

1. Attacker prepares a weaponized PDF designed to trigger prototype pollution in vulnerable Acrobat or Acrobat Reader versions.
2. Attacker sends or hosts the PDF using phishing, file-sharing links, compromised websites, or other social engineering delivery methods.
3. Victim opens the malicious PDF in an affected Acrobat or Reader version on Windows or macOS.
4. The PDF triggers malformed JavaScript/object handling and obtains code execution in the context of the current user.
5. Malicious code launches a second-stage payload or built-in system tools such as command shells, scripting engines, or download utilities.
6. Attacker performs follow-on actions such as credential theft, reconnaissance, persistence, data staging, or lateral movement depending on user privileges and endpoint defenses.

How to detect it

To determine whether exploitation already occurred, correlate document-open events, email attachment delivery, web downloads, EDR process telemetry, and network logs. Focus on instances where Acrobat.exe, AcroRd32.exe, or Adobe Acrobat/Reader on macOS opened a recently received PDF and then spawned child processes, made outbound network connections, wrote executable files, or modified persistence locations. Review email security logs for external PDFs delivered to users, especially messages followed by endpoint detections or unusual process trees. Inspect EDR telemetry for Acrobat/Reader launching command shells, scripting engines, living-off-the-land binaries, archive utilities, or download tools. On Windows, review Sysmon Event ID 1 process creation, Event ID 3 network connections, Event ID 11 file creation, Event ID 13 registry value changes, Security 4688 process creation, PowerShell logs, and Defender/EDR alerts. On macOS, review Unified Logs, EndpointSecurity/EDR events, quarantine metadata, LaunchAgents/LaunchDaemons creation, shell history where available, and unexpected child processes from Adobe applications. Examine suspicious PDFs for embedded JavaScript, OpenAction triggers, Launch actions, unusual object streams, obfuscation, or prototype-related strings such as __proto__ and constructor.prototype. Because no universally unique exploit string is available from the input, detection should rely on behavioral indicators and file triage rather than a single signature. Include threat-intelligence references for active exploitation and the reported BlueHammer association when prioritizing hunts.

• AcroRd32.exe spawning cmd.exe
• AcroRd32.exe spawning powershell.exe
• AcroRd32.exe spawning wscript.exe
• AcroRd32.exe spawning cscript.exe
• AcroRd32.exe spawning mshta.exe
• AcroRd32.exe spawning rundll32.exe
• AcroRd32.exe spawning regsvr32.exe
• AcroRd32.exe spawning certutil.exe
• AcroRd32.exe spawning curl.exe
• Acrobat.exe spawning cmd.exe
• Acrobat.exe spawning powershell.exe
• Acrobat.exe spawning wscript.exe
• Acrobat.exe spawning cscript.exe
• Acrobat.exe spawning mshta.exe
• Acrobat.exe spawning rundll32.exe
• Acrobat.exe spawning regsvr32.exe
• Acrobat.exe spawning certutil.exe
• Acrobat.exe spawning curl.exe
• /Applications/Adobe Acrobat Reader.app spawning /bin/sh
• /Applications/Adobe Acrobat Reader.app spawning /bin/bash
• /Applications/Adobe Acrobat Reader.app spawning /usr/bin/osascript
• /Applications/Adobe Acrobat Reader.app spawning /usr/bin/curl
• /Applications/Adobe Acrobat.app spawning /bin/sh
• /Applications/Adobe Acrobat.app spawning /bin/bash
• /Applications/Adobe Acrobat.app spawning /usr/bin/osascript
• /Applications/Adobe Acrobat.app spawning /usr/bin/curl
• /OpenAction
• /JavaScript
• /JS
• /Launch
• __proto__
• constructor.prototype
• AcroRd32.exe -> powershell.exe
• Acrobat.exe -> powershell.exe
• AcroRd32.exe -> mshta.exe
• Acrobat.exe -> mshta.exe
• AcroRd32.exe -> rundll32.exe
• Acrobat.exe -> rundll32.exe

What your security team should do

• Immediately identify endpoints running Acrobat or Acrobat Reader 24.001.30356, 26.001.21367, or earlier affected versions and prioritize remediation because this is in CISA KEV and actively exploited in the wild.
• Patch Acrobat and Acrobat Reader to the latest vendor-fixed versions using managed update tooling; enforce automatic updates where possible.
• Hunt for Acrobat or Reader spawning command interpreters, scripting engines, LOLBins, archive tools, or network download utilities, especially after PDF files were opened.
• Temporarily restrict Acrobat JavaScript and enforce Protected View/Protected Mode for documents from the internet or untrusted locations where business workflows allow.
• Deploy or tune EDR/application-control rules to block AcroRd32.exe or Acrobat.exe from launching cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl.exe, or similar tools.
• Increase scrutiny of inbound PDFs through secure email gateways, sandbox detonation, content disarm and reconstruction, and user-reporting workflows.
• Search email, proxy, EDR, and file telemetry for suspicious PDFs delivered shortly before anomalous Acrobat activity.
• Investigate activity associated with the reported BlueHammer exploitation context and any detections referring to Adobe Acrobat and Reader prototype pollution exploitation.
• For macOS, monitor Acrobat/Reader spawning shell interpreters, osascript, curl, or other utilities unexpectedly.
• Report remediation status against the CISA KEV due date of 2026-04-27 and treat overdue assets as exceptions requiring risk acceptance or compensating controls.