{"id":114,"date":"2026-04-13T10:00:00","date_gmt":"2026-04-13T10:00:00","guid":{"rendered":"https:\/\/thecybersecurity.network\/blog\/cve-2026-34621-adobe-acrobat-reader-zero-day-exploited-135-days\/"},"modified":"2026-04-13T10:00:00","modified_gmt":"2026-04-13T10:00:00","slug":"cve-2026-34621-adobe-acrobat-reader-zero-day-exploited-135-days","status":"publish","type":"post","link":"https:\/\/thecybersecurity.network\/blog\/cve-2026-34621-adobe-acrobat-reader-zero-day-exploited-135-days\/","title":{"rendered":"CVE-2026-34621: Adobe Acrobat Reader Zero-Day Exploited for 135 Days Before Patch \u2014 Full Attack Chain Analysis"},"content":{"rendered":"\n<p class=\"has-very-dark-gray-color has-luminous-vivid-amber-background-color has-text-color has-background\">&#x26A0;&#xFE0F; CISA KEV Alert: CVE-2026-34621 added to Known Exploited Vulnerabilities catalog on April 13, 2026. FCEB agencies must patch by April 27, 2026.<\/p>\n\n\n\n<p>Adobe has released emergency security updates for a critical zero-day vulnerability in <strong>Adobe Acrobat Reader<\/strong> that has been actively exploited in the wild since at least <strong>December 2025<\/strong>. Tracked as <strong>CVE-2026-34621<\/strong>, the flaw affects both Windows and macOS versions of Acrobat Reader and Acrobat and allows attackers to execute arbitrary code on victim systems by simply convincing a user to open a malicious PDF file.<\/p>\n\n\n\n<p>The vulnerability was first detected by EXPMON founder <strong>Haifei Li<\/strong>, who identified sophisticated zero-day exploitation in the wild using a weaponized PDF lure named <code>Invoice540.pdf<\/code>. The sample first appeared on VirusTotal on <strong>November 28, 2025<\/strong> \u2014 over four months before Adobe released a patch \u2014 meaning attackers had a significant head start.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Vulnerability Details: CVE-2026-34621<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>CVE ID:<\/strong> CVE-2026-34621<\/li><li><strong>CVSS Score:<\/strong> 8.6 (High) \u2014 revised from initial 9.6 Critical after Adobe updated attack vector from Network to Local<\/li><li><strong>Vulnerability Type:<\/strong> Prototype Pollution leading to Arbitrary Code Execution<\/li><li><strong>Affected Products:<\/strong> Adobe Acrobat Reader and Acrobat (Windows and macOS)<\/li><li><strong>Patch Status:<\/strong> Fixed in emergency update released April 12, 2026<\/li><li><strong>CISA KEV:<\/strong> Added April 13, 2026 \u2014 patch deadline April 27, 2026 for federal agencies<\/li><\/ul>\n\n\n\n<p><strong>Prototype pollution<\/strong> is a JavaScript vulnerability class that allows attackers to manipulate an application&#8217;s core object prototypes \u2014 the blueprints from which all JavaScript objects are created. When exploited in Adobe Reader&#8217;s PDF JavaScript engine, this allows the attacker to inject malicious properties into base objects, ultimately redirecting code execution to attacker-controlled functionality.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How the Attack Works: Zero-Day Exploitation Chain<\/h2>\n\n\n\n<p>The attack is delivered entirely through a specially crafted PDF document. Here is the full exploitation chain observed in the wild:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Phase 1 \u2014 Social Engineering Delivery<\/h3>\n\n\n\n<p>The weaponized PDF files use invoice-themed lures (<code>Invoice540.pdf<\/code>) to trick targets into opening them. Security researcher Gi7w0rm identified that observed samples contain <strong>Russian-language lures<\/strong> referencing issues in the Russian <strong>oil and gas industry<\/strong> \u2014 suggesting targeted spear-phishing against energy sector organizations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Phase 2 \u2014 Zero-Day Trigger<\/h3>\n\n\n\n<p>Upon opening the PDF in Adobe Reader, the document automatically triggers execution of <strong>obfuscated JavaScript<\/strong> without any additional user interaction. The JavaScript exploits CVE-2026-34621 to abuse <strong>privileged Acrobat APIs<\/strong> that are normally restricted to trusted code \u2014 bypassing Adobe Reader&#8217;s security sandbox model.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>The sample acts as an initial exploit with the capability to collect and leak various types of information, potentially followed by remote code execution (RCE) and sandbox escape (SBX) exploits. \u2014 Haifei Li, EXPMON<\/p><\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Phase 3 \u2014 Information Harvesting<\/h3>\n\n\n\n<p>With privileged API access established, the malicious JavaScript performs broad information collection including:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Local system fingerprinting and environment reconnaissance<\/li><li>Sensitive data collection from the filesystem<\/li><li>Advanced browser and application fingerprinting<\/li><li>Identification of security tools and sandbox detection<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Phase 4 \u2014 C2 Exfiltration and Follow-On Payloads<\/h3>\n\n\n\n<p>Collected data is exfiltrated to the attacker&#8217;s C2 server at <strong>169.40.2[.]68:45191<\/strong>. The C2 then responds with additional JavaScript payloads to be executed in the context of Adobe Reader. Researchers believe these follow-on payloads deliver:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Full <strong>Remote Code Execution (RCE)<\/strong> exploits<\/li><li><strong>Sandbox escape (SBX)<\/strong> to break out of Adobe Reader&#8217;s Protected Mode<\/li><li>Persistence mechanisms and additional malware stages<\/li><\/ul>\n\n\n\n<p>The exact next-stage payload was not recovered by researchers as the C2 server did not respond to requests from analysis environments \u2014 suggesting the attackers perform environment checks before delivering the payload, a common anti-analysis technique.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Timeline: From Zero-Day to Patch<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>November 28, 2025<\/strong> \u2014 First weaponized PDF sample (<code>Invoice540.pdf<\/code>) uploaded to VirusTotal. Exploitation likely begins.<\/li><li><strong>March 23, 2026<\/strong> \u2014 Second PDF sample uploaded to VirusTotal, confirming ongoing active exploitation.<\/li><li><strong>Early April 2026<\/strong> \u2014 EXPMON&#8217;s Haifei Li publicly discloses zero-day exploitation details.<\/li><li><strong>April 10, 2026<\/strong> \u2014 Security researchers confirm RCE capability; Adobe begins emergency patch development.<\/li><li><strong>April 12, 2026<\/strong> \u2014 Adobe releases emergency patch. CVSS score revised from 9.6 to 8.6 after attack vector update.<\/li><li><strong>April 13, 2026<\/strong> \u2014 CISA adds CVE-2026-34621 to KEV catalog. Federal patch deadline: <strong>April 27, 2026<\/strong>.<\/li><\/ul>\n\n\n\n<p>The gap between first exploitation (November 2025) and patch release (April 2026) represents approximately <strong>135 days of zero-day exposure<\/strong> \u2014 a significant window during which targeted organizations had no vendor-supplied defense.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Affected Products and Versions<\/h2>\n\n\n\n<p>The following Adobe products are affected on both <strong>Windows and macOS<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Adobe Acrobat Reader DC (Continuous Track) \u2014 versions prior to the April 2026 emergency update<\/li><li>Adobe Acrobat DC (Continuous Track) \u2014 versions prior to the April 2026 emergency update<\/li><li>Adobe Acrobat Reader 2024 (Classic Track) \u2014 versions prior to the April 2026 emergency update<\/li><li>Adobe Acrobat 2024 (Classic Track) \u2014 versions prior to the April 2026 emergency update<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Who is Being Targeted?<\/h2>\n\n\n\n<p>Based on the available evidence, the targeting profile includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Energy sector organizations<\/strong> \u2014 Russian-language oil and gas lures suggest targeted attacks against this sector<\/li><li><strong>Russian-speaking targets<\/strong> \u2014 or organizations with Russian business exposure<\/li><li><strong>Any Adobe Reader user<\/strong> \u2014 the vulnerability works on the latest version, meaning all unpatched users are at risk<\/li><li><strong>Government and critical infrastructure<\/strong> \u2014 CISA KEV listing confirms federal concern<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Indicators of Compromise (IOCs)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Malicious PDF Samples<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Filename: <code>Invoice540.pdf<\/code><\/li><li>VirusTotal hash (Sample 1): <code>54077a5b15638e354fa02318623775b7a1cc0e8c21e59bcbab333035369e377f<\/code><\/li><li>VirusTotal hash (Sample 2): <code>65dca34b04416f9a113f09718cbe51e11fd58e7287b7863e37f393ed4d25dde7<\/code><\/li><li>PDF files with invoice-themed names containing Russian-language content<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network IOCs<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>C2 server: <strong>169.40.2[.]68:45191<\/strong><\/li><li>Outbound connections from Adobe Reader processes to external IPs (highly suspicious)<\/li><li>JavaScript execution triggered automatically on PDF open<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Behavioral IOCs<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Adobe Reader spawning child processes or making network connections<\/li><li>Obfuscated JavaScript execution within PDF context<\/li><li>Privileged Acrobat API calls from untrusted document context<\/li><li>Data exfiltration from Adobe Reader process<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Immediate Actions Required<\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Update Adobe Reader immediately<\/strong> \u2014 Open Adobe Reader \u2192 Help \u2192 Check for Updates. Install the April 2026 emergency update<\/li><li><strong>Enable automatic updates<\/strong> \u2014 Edit \u2192 Preferences \u2192 Updater \u2192 Automatically install updates<\/li><li><strong>Block C2 at perimeter<\/strong> \u2014 Block outbound connections to <strong>169.40.2[.]68<\/strong> at your firewall<\/li><li><strong>Enable Protected Mode<\/strong> \u2014 Ensure Adobe Reader\u2019s Protected Mode (sandbox) is enabled: Edit \u2192 Preferences \u2192 Security (Enhanced)<\/li><li><strong>Scan for IOC hashes<\/strong> \u2014 Search for the known malicious PDF hashes across your environment<\/li><li><strong>Disable JavaScript in PDF<\/strong> \u2014 As a temporary mitigation if patching is delayed: Edit \u2192 Preferences \u2192 JavaScript \u2192 uncheck Enable Acrobat JavaScript<\/li><li><strong>Train users on PDF phishing<\/strong> \u2014 Invoice-themed PDFs from unknown senders should be treated as high-risk<\/li><li><strong>Federal agencies<\/strong> \u2014 CISA mandatory patch deadline is <strong>April 27, 2026<\/strong>. Treat this as P1.<\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Why This is More Serious Than the CVSS Score Suggests<\/h2>\n\n\n\n<p>Adobe revised the CVSS score from 9.6 to 8.6 after updating the attack vector from Network (AV:N) to Local (AV:L), reflecting that the attacker needs local access or user interaction (opening a PDF) to exploit the flaw. However, this revision <em>understates the real-world risk<\/em> for several reasons:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>PDF is a universal attack surface<\/strong> \u2014 email attachments, web downloads, and shared documents are trivial delivery mechanisms that effectively give attackers \u201clocal\u201d access via social engineering<\/li><li><strong>135+ day zero-day window<\/strong> \u2014 attackers had months to compromise targets before any patch existed<\/li><li><strong>Full RCE + sandbox escape potential<\/strong> \u2014 the follow-on payload capability extends impact far beyond information disclosure<\/li><li><strong>CISA KEV listed<\/strong> \u2014 active exploitation confirmed against real targets, not just theoretical<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">References<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/helpx.adobe.com\/security\/products\/acrobat\/apsb26-43.html\" rel=\"noopener noreferrer\" target=\"_blank\">Adobe Security Bulletin APSB26-43<\/a><\/li><li><a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/04\/13\/cisa-adds-seven-known-exploited-vulnerabilities-catalog\" rel=\"noopener noreferrer\" target=\"_blank\">CISA KEV Alert \u2014 April 13, 2026<\/a><\/li><li><a href=\"https:\/\/justhaifei1.blogspot.com\/2026\/04\/expmon-detected-sophisticated-zero-day-adobe-reader.html\" rel=\"noopener noreferrer\" target=\"_blank\">EXPMON \u2014 Zero-Day Discovery Report by Haifei Li<\/a><\/li><li><a href=\"https:\/\/thehackernews.com\/2026\/04\/adobe-patches-actively-exploited.html\" rel=\"noopener noreferrer\" target=\"_blank\">The Hacker News \u2014 Adobe Emergency Patch Coverage<\/a><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-34621\" rel=\"noopener noreferrer\" target=\"_blank\">NVD \u2014 CVE-2026-34621<\/a><\/li><\/ul>\n\n\n\n<p><em>Written by Tarang Parmar (CEH) \u2014 TheCyberSecurity.Network. Read time: 10 min. Last updated: April 13, 2026.<\/em><\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Adobe&#8217;s emergency patch for CVE-2026-34621 arrived 135 days after threat actors began exploiting this critical zero-day in Adobe Reader. The attack uses a prototype pollution flaw to execute privileged JavaScript from a malicious PDF \u2014 no click required beyond opening the document. CISA has added it to KEV with an April 27 federal deadline. Here is the full technical breakdown.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[42],"tags":[37,39,12,40,35],"class_list":["post-114","post","type-post","status-publish","format-standard","hentry","category-vulnerability","tag-critical","tag-cybersecurity","tag-rce","tag-threatintel","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/posts\/114","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/comments?post=114"}],"version-history":[{"count":0,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/posts\/114\/revisions"}],"wp:attachment":[{"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/media?parent=114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/categories?post=114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecybersecurity.network\/blog\/wp-json\/wp\/v2\/tags?post=114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}