Software leader Adobe released an emergency security update on Saturday aimed at addressing a highly severe zero-day vulnerability in Acrobat and Reader. Internet hackers have exploited this vulnerability for months in active attacks using malicious PDF files. In a move reflecting the severity of the situation, the company urged all affected users to install the updates within no more than 72 hours to avoid falling victim to these cyberattacks.
Vulnerability details and severity level
This security flaw is tracked as CVE-2026-34621 and is classified as a prototype pollution vulnerability. It received a very high severity score of 9.6 out of 10 according to the Common Vulnerability Scoring System (CVSS). According to Adobe’s security bulletin APSB26-43, successful exploitation of this vulnerability allows attackers to execute arbitrary code on both Windows and macOS systems simply by having the victim open a weaponized PDF file. The company officially confirmed that this vulnerability is under active exploitation by malicious actors.
Timeline of attack discovery
Security researcher Heifei Li, founder of vulnerability discovery platform EXPMON, was the first to publicly disclose this zero-day vulnerability on April 7 after his system detected a suspicious PDF file sample sent on March 26. Through in-depth investigations conducted by Li, it was revealed that this malicious campaign dates back to at least late November 2025, which is when the earliest known malicious file named “Invoice540.pdf” appeared on a malware scanning platform.
Technical mechanism of cyber exploitation
The attack mechanism relies on exploiting two high-privilege Adobe JavaScript APIs: util.readFileIntoStream and RSS.addFeed. Attackers use these interfaces to read local files, gather precise data about the victim’s system, and then exfiltrate this collected data to hacker-controlled servers. Instead of deploying a full malicious payload immediately, attackers first study and analyze targets, then selectively deliver second-stage exploits capable of remote code execution or escaping the sandbox environment of high-value systems.
“This advanced mechanism allows threat actors to gather user information, steal local files, and perform precise system fingerprinting, paving the way for more complex future attacks,” said researcher Heifei Li regarding the nature of this threat.
Targeting infrastructure and critical organizations
Meanwhile, malware researcher Giuseppe Massaro, who analyzed the discovered samples, found that the weaponized PDFs displayed Russian-language documents appearing as images acting as visual lures for victims. The contents of these documents include references to gas supply disruptions and emergency response procedures. This strongly indicates that the intended targets of this campaign are Russian-speaking individuals likely working in government institutions, energy sectors, or critical infrastructure.
Security patches and required preventative measures
Adobe issued the security patch under Priority Rating 1, the company’s highest level of urgency. This update covers Acrobat and Reader versions 24.001.30356, 26.001.21367, and earlier versions. For organizations unable to perform an immediate update, a series of temporary measures is strongly recommended to secure their networks.
- Disable JavaScript execution in Adobe Reader.
- Route untrusted PDFs to alternative viewers that do not support Adobe’s extended JavaScript APIs.
- Block HTTP and HTTPS traffic containing the phrase “Adobe Synchronizer” in the user-agent header.
Impact of zero-day vulnerabilities on cybersecurity
Zero-day vulnerabilities are among the most dangerous threats in the cybersecurity world, as malicious actors discover and exploit them long before the software developer realizes they exist. In the case of this vulnerability, the time gap between the start of exploitation in late 2025 and its disclosure in 2026 provided a golden opportunity for attackers to infiltrate sensitive networks and steal strategic data without leaving clear traces in the early stages. The growing reliance on digital document formats in daily work environments makes securing these applications a top priority.
Importance of zero-trust policy in organizations
This incident highlights the necessity for organizations to adopt a zero-trust strategy in their technical infrastructure. Through this approach, all incoming files, including common document formats, are treated as potential threats until proven otherwise. These sophisticated attacks also emphasize the importance of continuously updating systems and using advanced threat detection tools capable of analyzing abnormal software and application behavior to prevent the execution of any unauthorized code.
Frequently asked questions
What are the details of Adobe’s emergency security update?
Adobe released an urgent update to fix zero-day vulnerability CVE-2026-34621 in Acrobat and Reader, which allows attackers to execute arbitrary code and take control of systems as soon as a user opens a malicious PDF file.
Who are the targeted victims in these cyberattacks?
Security analyses showed that attackers targeted Russian-speaking individuals through camouflage documents related to gas supply crises, indicating targeting of government institutions, energy sectors, and critical infrastructure.
What are the preventive measures for organizations that cannot update immediately?
It is recommended to disable JavaScript execution in Adobe Reader, use alternative and secure viewers to open untrusted files, and block data traffic that includes the phrase “Adobe Synchronizer” in the user agent to mitigate risks.
