CVE-2026-34621

Think of Adobe Acrobat Reader as a program that “understands” documents. This vulnerability is like a trick that can sneak extra instructions into a document so that, once someone opens it, the attacker can run harmful code on that same computer. In a business, that can mean attackers taking over what your logged-in user can do.

This affects businesses that have Adobe Acrobat DC or Adobe Acrobat installed and used by staff to open PDF files. It matters because the attacker’s path is mainly social/targeted: a user must open a malicious file for the code execution to occur.

Per the findings, there’s no known requirement for the attacker to already have an account, but the practical risk depends on whether an attacker can get someone to open a crafted document (the “user opens a malicious file” gate).

This is urgent because CISA has added CVE-2026-34621 to its KEV list, meaning it meets criteria for serious, actionable risk. The weakness can lead to arbitrary code execution when a user opens a malicious file, so delaying updates increases the chance a real-world attacker can succeed.

Follow the CISA KEV remediation due date of 2026-04-27 and update to the fixed Acrobat versions as soon as possible.