PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-28550 Adobe CVE debrief

CVE-2021-28550 is an Adobe Acrobat and Reader use-after-free vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2021-11-03. Because it is KEV-listed, organizations should treat it as a high-priority remediation item and apply Adobe updates according to vendor instructions without delay. CISA’s KEV entry also lists the ransomware-campaign status as unknown, so the main concern is confirmed exploitation risk rather than a specific campaign attribution.

Vendor
Adobe
Product
Acrobat and Reader
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2021-11-03
Original CVE updated
2021-11-03
Advisory published
2021-11-03
Advisory updated
2021-11-03

Who should care

Security teams, endpoint administrators, vulnerability management teams, and any organization that uses Adobe Acrobat or Adobe Reader on managed workstations should prioritize this CVE. It is especially important for teams responsible for fast patch deployment and exposure reduction on user endpoints.

Technical summary

The vulnerability is described as a use-after-free issue in Adobe Acrobat and Reader. The supplied sources do not provide deeper technical details such as affected versions, exploit mechanics, or impact scope, so the safest evidence-based characterization is that it is a memory-safety flaw significant enough to be listed in CISA’s Known Exploited Vulnerabilities catalog.

Defensive priority

High. KEV inclusion means CISA has identified this CVE as exploited in the wild and set a remediation due date of 2021-11-17 in the supplied metadata. This places it above routine patching work and into urgent remediation status.

Recommended defensive actions

  • Apply Adobe updates per vendor instructions as soon as possible.
  • Prioritize remediation on internet-connected and user-facing endpoints that run Acrobat or Reader.
  • Verify asset inventory to identify all installed Acrobat and Reader instances.
  • Confirm patch deployment and validate that vulnerable versions are removed from the environment.
  • If immediate patching is not possible, apply compensating controls such as restricting use on high-risk systems and monitoring for suspicious application behavior.

Evidence notes

Evidence is limited to the supplied official and CISA KEV metadata. The CVE is identified by Adobe as a use-after-free vulnerability, and CISA lists it in the KEV catalog with dateAdded 2021-11-03 and dueDate 2021-11-17. The source metadata states knownRansomwareCampaignUse is Unknown. No CVSS score or affected-version details were provided in the supplied corpus, so those fields are intentionally omitted here.

Official resources

Publicly disclosed on 2021-11-03 and added to CISA’s Known Exploited Vulnerabilities catalog the same day, with a remediation due date of 2021-11-17 in the supplied metadata.