Critical 9.6
KEV-listed
CVE-2026-34621
Active Exploitation of CVE-2026-34621 in Adobe Acrobat and Reader
Vendor / product: Adobe Acrobat, Adobe Acrobat Reader
Event date: 2025-11-28
Public PoC: Yes
First tracked by RiskWire: 2026-10-26
CISA KEV catalog
Added to KEV
Federal remediation due
2026-04-27 (182 days overdue)
Ransomware campaign use
Unknown
CISA description
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Sources & citations (1)
- Adobe、Acrobat／Readerに深刻な脆弱性 すでに悪用確認、早めの更新を推奨 home.kingsoft.jp · 2026-10-25
References
See CVE-2026-34621 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →