CVE-2026-34621 – Actively Exploited Zero-Day in Adobe Reader
A zero-day vulnerability in Adobe Acrobat and Reader lets attackers steal data and run malicious code as soon as a PDF file is opened. It was actively exploited for months. Adobe has released an update – install it if you haven't already.
Update of October 22, 2026
Adobe has fixed the vulnerability with security bulletin APSB26-43. It is tracked as CVE-2026-34621 (CVSS 8.6) and is listed in the US agency CISA's catalog of known exploited vulnerabilities. Besides Windows, macOS is affected too. The fixed versions are listed below under "What needs to be done?".
What happened?
A zero-day vulnerability was discovered in Adobe Acrobat Reader that was already being exploited in attacks. The first crafted files appeared in late 2025, so the attacks ran for several months before the flaw became known.
As soon as a user opens a crafted PDF file, embedded JavaScript uses privileged interfaces (such as util.readFileIntoStream) to access the local file system. It can silently read files, send them to external servers through a built-in feed function and download further malicious code. Because the attack starts as soon as the document is opened, without the user clicking a link or doing anything else, phishing campaigns using it are very effective.
Who is affected?
- Windows and macOS users of Adobe Acrobat Reader DC and Acrobat DC up to version 26.001.21367, and of Acrobat 2024 up to version 24.001.30356.
- SMEs in CH/FL: Departments handling many external documents (HR, accounting, procurement) are particularly at risk.
- Observed campaigns: So far with Russian-language lures from the oil and gas sector. The exploit can, however, be adapted at any time for general "invoice phishing" waves in Switzerland and Liechtenstein.
What needs to be done?
- Install the update: Update Acrobat Reader DC and Acrobat DC to version 26.001.21411, and Acrobat 2024 to 24.001.30362 (Windows) or 24.001.30360 (macOS). In the application via Help → Check for Updates, in managed environments via your central software distribution.
- Verify the rollout: Check that the update has actually reached every device – including rarely used machines and those with automatic updates disabled.
- If you cannot update right away: Temporarily open PDF files with a different program (e.g. the PDF viewer in Chrome, Edge or Firefox), or disable JavaScript in Adobe Reader: Menu → Edit → Preferences → JavaScript → uncheck 'Enable Acrobat JavaScript'.
- Tighten email filters: Configure your email gateway to inspect PDF attachments from unknown or external sources strictly, or open them in an isolated sandbox.
- Check for compromise: Since the flaw was exploited before the patch, it is worth looking back: search for PDF files that call
util.readFileIntoStream, and for Acrobat or Reader processes that make unusual connections or start other processes shortly after a document is opened.
This advisory is for informational purposes. For support in securing your workstations, contact us.
Ready to know your attack surface?
Tell us briefly about your project. We'll come back with a concrete proposal.
Request a first call