Adobe Acrobat Reader: CVE-2026-34621 Active Exploitation & Patching

CVE-2026-34621: Acrobat Reader Under Active Attack

Just saw the alert drop on CVE-2026-34621. Adobe has released an emergency out-of-band patch for Acrobat and Acrobat Reader. This one is nasty—CVSS 8.6 (High) and confirmed to be exploited in the wild. Successful exploitation allows for arbitrary code execution, which is basically a game-over for the user session.

Given how ubiquitous PDF handling is in most environments, this should be treated as a priority update today. If you can't patch immediately, you need to tighten your allow-lists.

Patch Verification

For those running fleet management, here is a quick PowerShell snippet to identify vulnerable versions (adjust version logic based on the specific patched release notes for your environment):

Get-ItemProperty "HKLM:\Software\Wow6432Node\Adobe\Product Transformers\*", "HKLM:\Software\Adobe\Acrobat Reader\*" -ErrorAction SilentlyContinue |
Select-Object PsChildName, DisplayVersion | 
Where-Object { $_.DisplayVersion -lt "24.003.20100" }

Detection Logic

For the SOC folks, we should be hunting for suspicious child processes spawned by the Reader executable. Legitimate usage rarely spawns a shell or powershell directly.

DeviceProcessEvents
| where FileName in~ ("AcroRd32.exe", "Acrobat.exe")
| where InitiatingProcessFileName in~ ("AcroRd32.exe", "Acrobat.exe")
| where ProcessCommandLine contains "-EncodedCommand" or ProcessCommandLine contains ".ps1"

Who else is seeing active exploitation attempts targeting this specific vulnerability yet? I'm curious if the delivery mechanism is standard phishing maldocs or something more stealthy.