# Adobe Acrobat and Reader updates address multiple vulnerabilities including…

Published: 2026-04-12 · Severity: critical
Canonical: https://vorant.io/reports/a6ae47ae-cb48-46a8-9d79-580ebaf12730/adobe-acrobat-and-reader-updates-address-multiple-vulnerabilities-including

> Adobe Acrobat and Reader updates address multiple vulnerabilities including CVE-2026-34621, which Adobe confirms is being actively exploited in the wild.

On April 11, 2026 (Japan time), Adobe released security updates for Acrobat and Reader addressing multiple vulnerabilities. Exploitation of these flaws could result in application crashes or allow attackers to gain control of affected systems. Of particular concern is CVE-2026-34621, for which Adobe has confirmed active exploitation. The Japan Information-technology Promotion Agency (IPA) is urging immediate patching due to the risk of widespread attacks.

Affected versions include Acrobat and Reader 26.001.21367 and earlier on both Windows and macOS platforms, as well as version 24.001.30356 and earlier. Adobe has released updated versions to remediate these vulnerabilities.

Organizations and IT administrators are advised to apply security updates immediately. For most users, Adobe products will automatically download and install critical updates. Those managing software updates centrally should consult Adobe's security bulletin and prioritize deployment of these patches.

## Mentioned in this report

- Vulnerabilities: CVE-2026-34621 (KEV)

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Adobe Acrobat/Reader

ATT&CK: T1203

Detects command shells, script interpreters, or LOLBins spawned as children of Adobe Acrobat/Reader processes, indicative of exploitation via a malicious PDF (e.g., CVE-2026-34621). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by Adobe Acrobat/Reader
id: 05fd0360-83e5-5cca-bf02-a39afb67f631
status: experimental
description: Detects command shells, script interpreters, or LOLBins spawned as children
  of Adobe Acrobat/Reader processes, which is consistent with exploitation of client-side
  vulnerabilities such as CVE-2026-34621 leading to code execution.
references:
- https://helpx.adobe.com/security/products/acrobat.html
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \Acrobat.exe
    - \AcroRd32.exe
    - \RdrCEF.exe
    - \AcroCEF.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \wmic.exe
  condition: selection_parent and selection_child
falsepositives:
- Enterprise deployment scripts that launch helper processes from Acrobat plugins
- Custom PDF workflow automation tools that shell out from Acrobat add-ins
level: high
```

### Adobe Acrobat/Reader Process Writing Executable or Script to Disk

ATT&CK: T1203

Detects Adobe Acrobat/Reader creating executable, script, or DLL files outside of its normal installation/update directories, consistent with dropping a second-stage payload after successful exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Adobe Acrobat/Reader Process Writing Executable or Script to Disk
id: 02e8a315-62a4-533d-9440-9b18899d3902
status: experimental
description: Detects Acrobat/Reader processes writing executable, script, or library
  files to disk locations outside of legitimate installer/update paths, which may
  indicate payload drop following exploitation of a client-side vulnerability (e.g.,
  CVE-2026-34621).
references:
- https://helpx.adobe.com/security/products/acrobat.html
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \Acrobat.exe
    - \AcroRd32.exe
    - \RdrCEF.exe
    - \AcroCEF.exe
  selection_target:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .vbs
    - .js
    - .hta
    - .bat
  filter_legit_paths:
    TargetFilename|contains:
    - \Adobe\Acrobat DC\
    - \Adobe\Acrobat Reader DC\
    - \Common Files\Adobe\
    - \Adobe\ARM\
  condition: selection_image and selection_target and not filter_legit_paths
falsepositives:
- Adobe update/repair operations writing legitimate binaries under Adobe program directories
- Third-party plugin installers integrated with Acrobat
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/0413-adobereader.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a6ae47ae-cb48-46a8-9d79-580ebaf12730/adobe-acrobat-and-reader-updates-address-multiple-vulnerabilities-including.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup