CVE-2026-34621

CVE-2026-34621 is a prototype pollution vulnerability affecting Adobe Acrobat Reader versions 24.001.30356, 26.001.21367, and earlier. This flaw allows attackers to manipulate object prototype attributes, potentially enabling arbitrary code execution with the privileges of the current user. The vulnerability carries a CVSS score of 8.6 (HIGH), indicating significant risk. Attack requirements are minimal, as the flaw requires only local access and user interaction; specifically, a victim must open a malicious PDF file. Once exploited, the impact is severe, compromising confidentiality, integrity, and availability through code execution in the user's context. This vulnerability is actively exploited in the wild according to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating real-world threat activity. The FAUCET risk score of 86.0/100 reflects the high threat level, though the vulnerability is not currently on Adobe's hot list for immediate patching priorities. Organizations should prioritize patching affected Acrobat Reader versions and implement controls to prevent users from opening untrusted PDF files.