EUVD-2026-74200
GHSA-5p3x-77gx-c43v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttain low-privilege local code execution
-
DeliveryInvoke Acrobat's flawed authorization pathway
-
ExploitBypass privilege boundary check (CWE-863)
-
ExecutionExecute code in elevated OS context
-
ImpactFull system compromise (C:H/I:H/A:H)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a local low-privilege execution context on the target system (PR:L, AV:L) - the attacker must already be able to run code on the machine. Attack complexity is low (AC:L) with no timing or race conditions required, and no user interaction is needed (UI:N). The scope change means the exploitation breaks into a higher-privilege context (OS-level) beyond Acrobat's own sandbox. Limiting factors: remote-only attackers cannot trigger this without a prior local foothold; the vulnerability is not exploitable over the network absent a chained initial-access vector. Default installation of Acrobat Reader on a single-user system is sufficient to be affected - no non-default configuration is required. |
| Impact | The CVSS 8.8 score reflects a realistic and serious local privilege escalation: AV:L limits the attack surface to hosts where Acrobat is installed and where an attacker already has at least a low-privilege execution foothold, but AC:L and UI:N mean exploitation requires no special timing, race conditions, or victim interaction. The S:C flag elevating C/I/A all to High makes this a full-compromise scenario against the changed scope - effectively OS-level takeover from a restricted user account. Even a mid-sized municipal IT organization should treat this as urgent given how frequently Acrobat Reader is deployed in endpoint fleets. Without an EPSS score or KEV listing, widespread automated exploitation is not confirmed, but the low attack complexity means this is straightforwardly weaponizable in post-exploitation chains - for instance after an initial PDF-borne foothold. Real-world priority is high for environments with shared workstations, terminal servers, or any multi-user Windows/macOS deployment of Acrobat. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privilege shell on a Windows or macOS endpoint - for example via a malicious PDF exploit or compromised user credential - invokes a crafted interaction with Acrobat's privileged authorization pathway, bypassing the incorrect access check to gain SYSTEM or root-level code execution. Because no user interaction is required, this step can be automated immediately after the initial foothold. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Privilege escalation in Adobe Acrobat Reader and Adobe Acrobat (all editions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows a low-privileged local attacker to gain full elevated access via an Incorrect Authorization flaw (CWE-863). The CVSS scope-change indicator (S:C) with C:H/I:H/A:H confirms the vulnerability crosses a privilege boundary beyond Acrobat's own security domain - almost certainly compromising the underlying OS context. No user interaction is required, enabling silent exploitation once a foothold is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the vendor-released patch per Adobe Security Bulletin APSB26-141 at https://helpx.adobe.com/security/products/acrobat/apsb26-141.html, upgrading Acrobat Reader and Adobe Acrobat to versions above 26.002.21900 and Acrobat 2024 to versions above 24.001.30383. Adobe's built-in update mechanism (Help > Check for Updates) or enterprise deployment tools (SCCM, Intune, Jamf) can deliver the fix at scale. If immediate patching is not feasible, restricting Acrobat to run in a sandboxed or low-integrity application container reduces the impact of a scope-change exploit. Disabling privileged background services or broker processes associated with Acrobat may limit escalation paths but could break Protected Mode functionality - weigh operational impact before applying. Prioritize endpoints serving multiple users (RDS, VDI, shared workstations) where a low-privilege attacker is most likely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-863 (Incorrect Authorization) indicates the application performs an authorization check but uses flawed or insufficient criteria, permitting an operation that should be denied. In a desktop PDF reader context, this commonly manifests as improper permission validation in privileged IPC channels, COM/DCOM objects, named pipes, file system operations, or sandbox escape paths. The CVSS vector AV:L/PR:L/S:C confirms local code execution at low privilege is sufficient to trigger the flaw and break into a higher-privilege scope - likely the OS itself. Affected CPE-identified products per EUVD are Acrobat Reader and Adobe Acrobat through version 26.002.21900, and Acrobat 2024 through 24.001.30383. The advisory is tracked under Adobe APSB26-141, reported through Adobe PSIRT (psirt@adobe.com).
Know when Acrobat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local vector confirmed by description; PR:L matches 'low-privileged attacker'; S:C with full C/I/A reflects OS-scope privilege escalation with no interaction required.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Acrobat Reader and Acrobat (versions through 26.002.21900 and Acrobat 2024 through 24.001.30383) contain a local privilege escalation vulnerability enabling low-privileged users to gain full OS-level access without user interaction. This directly impacts any organization using these products, as compromised low-privileged accounts-common via phishing or lateral movement-can escalate to complete system control, enabling data exfiltration, malware installation, and lateral spread across the enterprise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict Acrobat Reader via application allowlists to essential users; (2) disable unnecessary Acrobat plugins and features; (3) enable OS sandboxing features (Windows Defender Application Guard, Microsoft Defender Exploit Guard, or macOS sandbox hardening); (4) enforce principle of least privilege to minimize low-privileged user presence; (5) monitor endpoint logs and EDR telemetry for local privilege escalation events; (6) evaluate alternative PDF readers for non-critical document workflows; (7) implement file reputation scanning to detect malicious PDFs that may trigger exploitation chains.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execu
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attack
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass inten
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Buffer overflow in Adobe Reader and Acrobat before 10.1.8 and 11.x before 11.0.04 on Windows and Mac OS X allows attacke
Exploit-DB