Adobe Reader zero-day CVE-2026-34621 exploited
Adobe has confirmed active exploitation of CVE-2026-34621 in Acrobat and Reader; patches are available and should be applied immediately.
Japan's IPA has issued an urgent security alert following Adobe's April 11, 2026 security update for Acrobat and Reader. The update addresses multiple vulnerabilities that could allow attackers to crash applications or achieve remote code execution, potentially enabling full system control.
Of particular concern is CVE-2026-34621, which Adobe has confirmed is being actively exploited in the wild. The vulnerability affects all versions up to and including 26.001.21367 for current releases and 24.001.30356 for extended support versions, across both Windows and macOS platforms. Given the confirmed exploitation, IPA warns that attacks are likely to escalate and urges immediate patching.
Adobe has released updated versions that address these flaws. While the software typically updates automatically, organizations with managed update policies should prioritize deployment. IT administrators are directed to consult Adobe's security bulletin for detailed remediation guidance.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Adobe Acrobat/Reader
Detects command interpreters or scripting engines launched as children of Acrobat/Reader, consistent with post-exploitation after a PDF-based RCE such as CVE-2026-34621. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Adobe Acrobat/Reader
id: a8dcad3b-ee15-53bb-bc13-11c771d65045
status: experimental
description: Detects Adobe Acrobat or Reader spawning command interpreters, scripting
hosts, or LOLBins, which is anomalous behaviour and may indicate exploitation of
a PDF reader vulnerability (e.g. CVE-2026-34621) leading to remote code execution.
references:
- Adobe Security Bulletin APSB26-xx (CVE-2026-34621)
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \AcroRd32.exe
- \Acrobat.exe
- \RdrCEF.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_updater:
Image|endswith:
- \AdobeARM.exe
- \AcroCEF.exe
condition: selection_parent and selection_child and not filter_updater
falsepositives:
- Adobe update or telemetry helper processes launched via legitimate scheduled tasks
- Enterprise deployment tools that invoke scripting hosts from a shared Acrobat installation
path
level: high
tags:
- attack.t1203
- attack.execution
author: Vorant
Adobe Acrobat/Reader Writing Executable or Script Files to Disk
Detects Acrobat/Reader processes creating executable, DLL, or script files, which can indicate a dropper stage following successful PDF exploit execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Acrobat/Reader Writing Executable or Script Files to Disk
id: 19ff50f0-5963-55fa-871b-c64fbe400c3d
status: experimental
description: Detects file creation of executables, DLLs, or scripts by Adobe Acrobat/Reader
processes, which is unusual behaviour outside of normal update or plugin activity
and may indicate a dropper payload following exploitation of a PDF reader vulnerability
(e.g. CVE-2026-34621).
references:
- Adobe Security Bulletin APSB26-xx (CVE-2026-34621)
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \AcroRd32.exe
- \Acrobat.exe
- \RdrCEF.exe
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .vbs
- .hta
- .bat
filter_install:
TargetFilename|contains:
- \Adobe\Acrobat\
- \Adobe\ARM\
condition: selection and not filter_install
falsepositives:
- Legitimate Adobe update or plugin components writing files within official Adobe
installation directories
- Third-party PDF plugin installers integrated with Acrobat
level: medium
tags:
- attack.t1203
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/0413-adobereader.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free