Adobe Acrobat and Reader patch actively exploited vulnerability
Adobe Acrobat and Reader updates address multiple vulnerabilities including CVE-2026-34621, which Adobe confirms is being actively exploited in the wild.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-34621 as exploited in the wild.
On April 11, 2026 (Japan time), Adobe released security updates for Acrobat and Reader addressing multiple vulnerabilities. Exploitation of these flaws could result in application crashes or allow attackers to gain control of affected systems. Of particular concern is CVE-2026-34621, for which Adobe has confirmed active exploitation. The Japan Information-technology Promotion Agency (IPA) is urging immediate patching due to the risk of widespread attacks.
Affected versions include Acrobat and Reader 26.001.21367 and earlier on both Windows and macOS platforms, as well as version 24.001.30356 and earlier. Adobe has released updated versions to remediate these vulnerabilities.
Organizations and IT administrators are advised to apply security updates immediately. For most users, Adobe products will automatically download and install critical updates. Those managing software updates centrally should consult Adobe's security bulletin and prioritize deployment of these patches.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Adobe Acrobat/Reader
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command shells, script interpreters, or LOLBins spawned as children of Adobe Acrobat/Reader processes, indicative of exploitation via a malicious PDF (e.g., CVE-2026-34621). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Adobe Acrobat/Reader
id: 05fd0360-83e5-5cca-bf02-a39afb67f631
status: experimental
description: Detects command shells, script interpreters, or LOLBins spawned as children
of Adobe Acrobat/Reader processes, which is consistent with exploitation of client-side
vulnerabilities such as CVE-2026-34621 leading to code execution.
references:
- https://helpx.adobe.com/security/products/acrobat.html
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \RdrCEF.exe
- \AcroCEF.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \wmic.exe
condition: selection_parent and selection_child
falsepositives:
- Enterprise deployment scripts that launch helper processes from Acrobat plugins
- Custom PDF workflow automation tools that shell out from Acrobat add-ins
level: high
Adobe Acrobat/Reader Process Writing Executable or Script to Disk
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Adobe Acrobat/Reader creating executable, script, or DLL files outside of its normal installation/update directories, consistent with dropping a second-stage payload after successful exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Acrobat/Reader Process Writing Executable or Script to Disk
id: 02e8a315-62a4-533d-9440-9b18899d3902
status: experimental
description: Detects Acrobat/Reader processes writing executable, script, or library
files to disk locations outside of legitimate installer/update paths, which may
indicate payload drop following exploitation of a client-side vulnerability (e.g.,
CVE-2026-34621).
references:
- https://helpx.adobe.com/security/products/acrobat.html
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
category: file_event
product: windows
detection:
selection_image:
Image|endswith:
- \Acrobat.exe
- \AcroRd32.exe
- \RdrCEF.exe
- \AcroCEF.exe
selection_target:
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .vbs
- .js
- .hta
- .bat
filter_legit_paths:
TargetFilename|contains:
- \Adobe\Acrobat DC\
- \Adobe\Acrobat Reader DC\
- \Common Files\Adobe\
- \Adobe\ARM\
condition: selection_image and selection_target and not filter_legit_paths
falsepositives:
- Adobe update/repair operations writing legitimate binaries under Adobe program directories
- Third-party plugin installers integrated with Acrobat
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/0413-adobereader.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs