InfoSecBulletin Cybersecurity for mankind
Adobe has put out urgent updates to fix a serious security problem in Acrobat Reader that is being actively used for attacks.
The flaw known as CVE-2026-34621 has a CVSS score of 8.6 out of 10. If an attacker takes advantage of this issue, they can run harmful code on the affected systems.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
It has been described as a case of prototype pollution that could result in arbitrary code execution. Prototype pollution refers to a JavaScript security vulnerability that permits an attacker to manipulate an application’s objects and properties.
The issue impacts the following products and versions for both Windows and macOS:
Acrobat DC versions 26.001.21367 and earlier (Fixed in 26.001.21411)
Acrobat Reader DC versions 26.001.21367 and earlier (Fixed in 26.001.21411)
Acrobat 2024 versions 24.001.30356 and earlier (Fixed in 24.001.30362 for Windows and 24.001.30360 for macOS)
Adobe acknowledged that it’s “aware of CVE-2026-34621 being exploited in the wild.”
The news arrives shortly after security expert Haifei Li, who started EXPMON, shared information about a serious flaw. This flaw lets bad actors run harmful JavaScript code when opening special PDF files in Adobe Reader. Some proof shows that this problem might have been used for attacks since December 2025.
“It appears that Adobe has determined the bug can lead to arbitrary code execution — not just an information leak,” EXPMON said in a post on X. “This aligns with our findings and those of other security researchers over the last few days.”
