PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-28550 Adobe CVE debrief

CVE-2021-28550 is an Adobe Acrobat and Reader use-after-free vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2021-11-03. Because it is KEV-listed, organizations should treat it as a high-priority remediation item and apply Adobe updates according to vendor instructions without delay. CISA’s KEV entry also lists the ransomware-campaign status as unknown, so the main concern is confirmed exploitation risk rather than a specific campaign attribution.

Vendor
Adobe
Product
Acrobat and Reader
CVSS
CRITICAL 9.6
CISA KEV
Listed
Original CVE published
2021-11-03
Original CVE updated
2021-11-03
Advisory published
2021-11-03
Advisory updated
2021-11-03

Who should care

Security teams, endpoint administrators, vulnerability management teams, and any organization that uses Adobe Acrobat or Adobe Reader on managed workstations should prioritize this CVE. It is especially important for teams responsible for fast patch deployment and exposure reduction on user endpoints.

Technical summary

The vulnerability is described as a use-after-free issue in Adobe Acrobat and Reader. The supplied sources do not provide deeper technical details such as affected versions, exploit mechanics, or impact scope, so the safest evidence-based characterization is that it is a memory-safety flaw significant enough to be listed in CISA’s Known Exploited Vulnerabilities catalog.

Defensive priority

High. KEV inclusion means CISA has identified this CVE as exploited in the wild and set a remediation due date of 2021-11-17 in the supplied metadata. This places it above routine patching work and into urgent remediation status.

Recommended defensive actions

  • Apply Adobe updates per vendor instructions as soon as possible.
  • Prioritize remediation on internet-connected and user-facing endpoints that run Acrobat or Reader.
  • Verify asset inventory to identify all installed Acrobat and Reader instances.
  • Confirm patch deployment and validate that vulnerable versions are removed from the environment.
  • If immediate patching is not possible, apply compensating controls such as restricting use on high-risk systems and monitoring for suspicious application behavior.

Evidence notes

Evidence is limited to the supplied official and CISA KEV metadata. The CVE is identified by Adobe as a use-after-free vulnerability, and CISA lists it in the KEV catalog with dateAdded 2021-11-03 and dueDate 2021-11-17. The source metadata states knownRansomwareCampaignUse is Unknown. No CVSS score or affected-version details were provided in the supplied corpus, so those fields are intentionally omitted here.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-28550 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-28550

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-28550 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-28550

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.