Evidence dossier

CVE-2026-34621

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

66.8–81.8Priority evidence range

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

State: PUBLISHED
Published: Apr 11, 2026
Updated: Apr 14, 2026
Evidence coverage: 85%

CISA KEVCatalog member

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

FIRST EPSS7.09%

2026-07-18 · v2026.06.15 · percentile 93.5%

Source stateNo scored conflict

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

adobeoriginal assertion

container

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

Jul 19, 2026Original evidence ↗

CISA-ADPindependent enrichment

container

CISA ADP Vulnrichment

Jul 19, 2026Original evidence ↗

CISA KEVoriginal assertion

observed_exploitation

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Jul 19, 2026Original evidence ↗

FIRST EPSSoriginal assertion

model_probability

Probability 0.070860000000; percentile 0.935110000000

Jul 19, 2026Original evidence ↗

Applicability

Cited product scope

Trace impact →

AdobeAcrobat Reader

[{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "26.001.21367"}]unknown