Adobe Acrobat Zero-Day Under Active Exploitation, Three Agencies Warn

The Cyber Security Agency of Singapore issued an advisory on April 13 warning of active exploitation of CVE-2026-34621, a critical prototype pollution vulnerability in Adobe Acrobat and Reader for Windows and macOS. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable systems.

CERT-FR released a parallel advisory detailing the vulnerability affecting Acrobat 2024 and Acrobat Classic 2020 versions. CISA subsequently added CVE-2026-34621 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to remediate the flaw by May 4, 2026.

CISA also added CVE-2020-9715, a historical Adobe vulnerability, to the KEV catalog, suggesting ongoing attack campaigns leveraging multiple Adobe flaws. Organizations should immediately update Adobe Acrobat and Reader to patched versions to prevent compromise.