Critical CVE-2026-34621 vulnerability puts organizations at risk through malicious PDFs
Adobe has released urgent updates to fix a critical security flaw in Acrobat Reader. The vulnerability, tracked as CVE-2026-34621, is already being exploited in real-world attacks.
The flaw has a CVSS score of 8.6. Attackers can use it to run malicious code on affected systems.
How the Attack Works
This issue is caused by a prototype pollution vulnerability in JavaScript. Attackers can manipulate how the application handles objects.
As a result, they can inject malicious code into PDF files. When a user opens the file, the attack executes.
Security researcher Haifei Li confirmed that attackers are using crafted PDFs with embedded JavaScript. These files trigger the exploit when opened.
Affected Versions
The vulnerability impacts the following versions:
- Acrobat DC and Reader DC before version 26.001.21411
- Acrobat 2024 before version 24.001.30362 (Windows)
- Acrobat 2024 before version 24.001.30360 (macOS)
Users must update immediately to stay protected.
Why This Matters
Initially, experts believed this flaw caused only data exposure. However, further analysis confirmed full code execution.
This makes the vulnerability far more dangerous.
Additionally, Adobe changed the attack vector from network to local. However, this does not reduce risk. Users often open files from email or downloads.
Therefore, attackers can still exploit this flaw easily.
Business Impact and Risk
PDF files are widely trusted in business environments. However, attackers continue to use them as entry points.
Organizations in finance, legal, and government sectors face higher risk. These industries rely heavily on document sharing.
In the UAE and GCC region, this threat is especially relevant. Phishing campaigns often use document-based attacks.
What Organizations Should Do
- Apply security updates immediately
- Restrict JavaScript execution in PDF readers
- Train employees to avoid opening unknown files
- Use endpoint protection and email filtering
A fast response can prevent larger security incidents.