CVE-2026-34621: Prototype pollution leading to RCE in Adobe Acrobat Reader

Summary

Parameter	Value
CVE ID	CVE-2026-34621
Alert Source	GitHub Advisory - Critical Vulnerability
CVE Publication Year	2026
Date Published	2026-04-11
Vendor	Adobe
Product	Acrobat Reader
CVSS Score	9.6 (critical)
EPSS Score	No data
CISA KEV	No
Ransomware	Not confirmed

Vulnerability Description

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Required Actions

Apply vendor patches or mitigations as soon as available.

Who Is Affected?

This vulnerability affects Acrobat Reader by Adobe. Check if your organization uses this software and requires updates.

Sources

• NVD - CVE-2026-34621

• FIRST EPSS

---

Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.

How can nFlo help?

If your organization uses products affected by this vulnerability, contact us. We can help with:

• Verifying whether your systems are at risk
• Implementing patches and risk mitigation
• Monitoring for exploitation attempts in your environment

Useful resources:

• Incident response management
• SOC — Security Operations Center
• nFlo penetration testing