Loading story…
Attackers are actively exploiting an unpatched Adobe Reader/Acrobat zero-day through malicious PDF files that trigger when a victim simply opens the document. Research from EXPMON says the exploit has been used since at least December and works against the latest Reader versions, abusing Acrobat JavaScript and internal APIs including util.readFileIntoStream and RSS.addFeed to bypass sandbox protections, read local files, fingerprint the host, and exfiltrate data to attacker-controlled infrastructure.
The malicious PDFs reportedly contain hidden Base64-encoded objects and can fetch additional encrypted JavaScript payloads when a target matches attacker criteria, creating a path to follow-on attacks such as remote code execution or sandbox escape. Analysts said some lures were written in Russian and themed around developments in the Russian oil and gas sector. Adobe was notified through responsible disclosure, but no patch was available at the time of reporting; defenders were urged to avoid untrusted PDFs and monitor or block traffic to 169.40.2.68:45191 and HTTP/HTTPS requests using the Adobe Synchronizer User-Agent string.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
STAR Labs reported that the in-the-wild Acrobat/Reader exploitation involved a prototype-pollution-based chain spanning CVE-2026-34621, CVE-2026-34622, and CVE-2026-34626. Their reverse engineering indicated Adobe first patched CVE-2026-34621 and then issued a follow-up update two days later for the other two bugs, suggesting the initial emergency fix did not fully break the chain.
Adobe updated its assessment of CVE-2026-34621 on 2026-04-12, lowering the CVSS score from 9.6 to 8.6 after changing the attack vector from network to local. The revision clarified that exploitation requires local access and user interaction, despite the flaw being actively exploited in the wild.
Adobe issued security updates for Acrobat and Acrobat Reader to fix CVE-2026-34621, a prototype pollution vulnerability that was being actively exploited in the wild via malicious PDF files. The patches covered affected Windows and macOS product lines including Acrobat DC, Acrobat Reader DC, and Acrobat 2024.
Threat intelligence analysis found the malicious PDFs used Russian-language lures tied to current events in the Russian oil and gas industry, indicating targeted social engineering in the exploitation campaign.
Public reporting revealed the exploit's use of Acrobat JavaScript, hidden Base64-encoded PDF objects, and abused internal APIs, along with indicators including traffic to 169.40.2.68:45191 and the "Adobe Synchronizer" User-Agent string. Defenders were advised to avoid untrusted PDFs and monitor or block related traffic.
Researchers using the EXPMON threat-hunting system identified the actively exploited, unpatched Adobe Reader zero-day and responsibly disclosed the vulnerability to Adobe Security. At the time of reporting, no patch was available and Adobe had not publicly responded.
On 2026-03-26, researcher Haifei Li identified a suspicious PDF after EXPMON flagged it despite low antivirus detection on VirusTotal. Analysis showed the sample exploited a zero-day against fully updated Adobe Reader and helped uncover the active campaign.
Attackers were exploiting an Adobe Reader zero-day through malicious PDF documents by at least December 2025. The exploit required only that a victim open the PDF and enabled theft of local data, with potential for follow-on remote code execution or sandbox escape.
Security researcher Haifei Li reported that unknown attackers had been exploiting the Adobe Acrobat Reader zero-day via malicious PDF files since at least November 2025. The finding pushes the known start of the campaign earlier than previously documented.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
25 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcetechrepublic.com
Open sourcetechcrunch.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcejusthaifei1.blogspot.com
Open sourcepub.expmon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A previously undisclosed **Adobe Reader** vulnerability was reported as being actively exploited in the wild through specially crafted PDF files containing obfuscated JavaScript. The flaw allows attackers to invoke privileged Acrobat APIs, enabling theft of sensitive user and system information and creating a path for follow-on compromise, including potential remote code execution. Reporting indicates the activity began no later than December 2025 and was publicly disclosed by a security researcher in April 2026. The campaign appeared to be targeted rather than opportunistic, using Russian-language lure documents associated with the Russian oil and gas sector. Defenders were urged to monitor for an official Adobe fix, scrutinize and block suspicious PDF email attachments, educate users about unsolicited files, and consider avoiding Adobe Reader for PDF handling where practical until patched. Researchers also published indicators of compromise, including malicious PDF hashes, a command-and-control domain, IP:port infrastructure, and a related user-agent string.
Jun 29, 2026
JPCERT/CC warned that multiple vulnerabilities in **Adobe Acrobat** and **Adobe Acrobat Reader** could lead to arbitrary code execution on both Windows and macOS, including flaws tracked in Adobe bulletins `APSB26-43` and `APSB26-44`. Adobe said exploitation of the `APSB26-43` issues has been confirmed, while JPCERT/CC noted it had not observed attacks in Japan at publication time and cautioned that broader abuse could follow as technical details spread. The affected products include **Adobe Acrobat DC Continuous**, **Adobe Acrobat Reader DC Continuous**, and **Adobe Acrobat 2024 Classic** up to the vulnerable versions identified by Adobe. JPCERT/CC urged organizations and users to update immediately to the latest patched releases, including `26.001.21431` for the DC Continuous branch and `24.001.30365` for Acrobat 2024 Classic, because opening maliciously crafted content may be enough to trigger remote code execution.
Jun 29, 2026
German authorities issued security advisories for **Adobe Acrobat DC**, **Acrobat Reader DC**, and **Adobe Acrobat Reader** covering multiple vulnerabilities that could allow **information disclosure** and **arbitrary code execution**. One advisory specifically warned that a flaw in Adobe Acrobat Reader could expose sensitive information and be leveraged for code execution, raising the risk of compromise when users open maliciously crafted PDF files. A follow-up advisory expanded the scope to **multiple vulnerabilities** across Adobe’s Acrobat product line, indicating broader exposure for enterprise and end-user systems that rely on Adobe PDF software. Organizations using affected Adobe applications should prioritize vendor patches and review endpoint protections, as successful exploitation could give attackers access to data or the ability to run code on targeted systems.
Jun 29, 2026