CVE-2026-34626 Adobe CVE debrief

Who should care

Organizations and individuals using Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362, and earlier should be aware of this vulnerability and take necessary defensive actions to prevent exploitation.

Technical summary

The CVE-2026-34626 vulnerability is an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') issue affecting Adobe Acrobat Reader. This vulnerability could result in arbitrary file system read in the context of the current user when a victim opens a malicious file. The CVSS score for this vulnerability is 6.3, indicating a medium severity level. The vulnerability affects Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362, and earlier. Evidence is based on official CVE Program and NVD records. To address this vulnerability, it is recommended to apply vendor patches or updates as recommended by Adobe, monitor user interactions with files, especially malicious files, to prevent exploitation, and implement compensating controls, such as restricting file system access, if patching is not immediately feasible.

Defensive priority

Medium-priority defensive actions are recommended due to the CVSS score of 6.3 and the potential for arbitrary file system read in the context of the current user.

Recommended defensive actions

• Inventory and verify Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362, and earlier for potential vulnerability.
• Apply vendor patches or updates as recommended by Adobe.
• Monitor user interactions with files, especially malicious files, to prevent exploitation.
• Implement compensating controls, such as restricting file system access, if patching is not immediately feasible.
• Educate users about the risks of opening malicious files and the importance of keeping software up-to-date.

Evidence notes

The CVE-2026-34626 vulnerability affects Adobe Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362, and earlier, allowing for arbitrary file system read in the context of the current user upon opening a malicious file. Evidence is based on official CVE Program and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.