What is the CVSS score of EUVD-2026-21675?

EUVD-2026-21675 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Prototype Pollution are affected by EUVD-2026-21675?

Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier contain a critical prototype pollution vulnerability (CVSS 9.6) that enables unauthenticated remote code execution when users open…

Is there a public PoC exploit available for EUVD-2026-21675?

Yes, a public proof-of-concept exploit is available for EUVD-2026-21675. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-21675?

Within 24 hours: Inventory all systems running Adobe Acrobat Reader versions 24.001.30356 or 26.001.21367 and earlier; disable PDF opening in email clients and restrict Adobe Reader to trusted document sources only. Within 7 days: Deploy endpoint controls blocking unsigned PDF execution; implement network segmentation isolating systems that require PDF processing; consider temporary use of alternative PDF viewers for non-critical workflows. Within 30 days: Monitor Adobe security advisories for patch release; test patch in isolated environment immediately upon vendor release; deploy patch to all vulnerable systems with priority to users receiving external documents.

Prototype Pollution EUVD-2026-21675

| CVE-2026-34621 HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-04-11 psirt@adobe.com

GHSA-vcqh-932g-m3qj

Prototype Pollution RCE Adobe

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Apr 13, 2026 - 18:02 CISA

Severity Changed

Apr 12, 2026 - 05:22 NVD

CRITICAL HIGH

CVSS changed

Apr 12, 2026 - 05:22 NVD

9.6 (CRITICAL) 8.6 (HIGH)

EUVD ID Assigned

Apr 11, 2026 - 07:25 euvd

EUVD-2026-21675

Analysis Generated

Apr 11, 2026 - 07:25 vuln.today

CVE Published

Apr 11, 2026 - 07:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Articles & Coverage 1

POC CVE-2026-34621: Prototype Pollution in Adobe Acrobat Reader RCE PoC Apr 13, 2026

AnalysisAI

Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execution in user context via malicious PDF files. Attack requires user interaction to open a crafted document. CVSS 9.6 (Critical) reflects network-deliverable code execution with scope change, though EPSS 0.24% (46th percentile) suggests moderate real-world exploitation probability. No public exploit identified at time of analysis.

Technical ContextAI

This vulnerability exploits CWE-1321 (Prototype Pollution), a class of attack where attackers modify JavaScript object prototypes in runtime environments. Adobe Acrobat Reader embeds JavaScript engines for PDF interactivity (form validation, calculations, document actions). By injecting malicious properties into Object.prototype or other built-in prototypes through specially crafted PDF JavaScript, attackers can alter application behavior globally. When legitimate code accesses polluted properties, the injected values trigger unintended execution paths. Affected versions span Acrobat Reader 24.001.30356, 26.001.21367 and all earlier releases (per EUVD data confirming versions 0 through 26.001.21367). The scope change (S:C) in CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component's security scope, consistent with JavaScript prototype chains influencing application-wide execution contexts.

RemediationAI

Apply vendor-released patches from Adobe Security Bulletin APSB26-43 available at https://helpx.adobe.com/security/products/acrobat/apsb26-43.html. While the input data does not specify exact fixed versions, Adobe's standard patching cadence typically releases updates simultaneously with bulletin publication-consult APSB26-43 for platform-specific installers and fixed version numbers. Enterprise deployments should use centralized update mechanisms (Adobe Update Server, SCCM, Intune) to ensure coverage across endpoints. Interim risk reduction measures include: disable JavaScript execution in Acrobat Reader preferences (Edit > Preferences > JavaScript > uncheck 'Enable Acrobat JavaScript'), though this may break legitimate PDF form functionality; implement email gateway filtering to block PDF attachments from untrusted sources; educate users on PDF phishing risks and suspicious document indicators (unexpected macro prompts, external resource loads). Protected View mode (if available in affected versions) provides sandboxing for untrusted documents but should not replace patching.