Loading story…
A previously undisclosed Adobe Reader vulnerability was reported as being actively exploited in the wild through specially crafted PDF files containing obfuscated JavaScript. The flaw allows attackers to invoke privileged Acrobat APIs, enabling theft of sensitive user and system information and creating a path for follow-on compromise, including potential remote code execution. Reporting indicates the activity began no later than December 2025 and was publicly disclosed by a security researcher in April 2026.
The campaign appeared to be targeted rather than opportunistic, using Russian-language lure documents associated with the Russian oil and gas sector. Defenders were urged to monitor for an official Adobe fix, scrutinize and block suspicious PDF email attachments, educate users about unsolicited files, and consider avoiding Adobe Reader for PDF handling where practical until patched. Researchers also published indicators of compromise, including malicious PDF hashes, a command-and-control domain, IP:port infrastructure, and a related user-agent string.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-13, a public forensic analysis of the Adobe Reader zero-day campaign disclosed additional technical details, including a hidden form field and JSFuck-obfuscated loader, internal UI API injection with prototype-pollution-based privilege escalation, and encrypted second-stage JavaScript delivery. The report also identified added infrastructure and behaviors such as 169.40.2.68:45191, AES-CTR/zlib payload handling, persistence via an Adobe Reader Synchronizer Run key, and AdobeCollabSync.exe process spawning.
On 2026-04-14, Adobe released an out-of-band security update for the actively exploited Acrobat/Reader flaw, tracked as CVE-2026-34621. The patch addressed arbitrary code execution via a malicious PDF in Acrobat DC, Acrobat Reader DC, and Acrobat 2024 on Windows and macOS.
On 2026-04-11, Adobe assigned CVE-2026-34621 to the actively exploited Acrobat/Reader zero-day. Public reporting described a PDF-based infection chain involving JavaScript engine abuse and prototype pollution, with selective targeting and a follow-on payload fetched from 188.214.34.20:34123.
On April 9, 2026, Sophos published reporting on the active exploitation, including defensive guidance and indicators of compromise such as malicious PDF hashes, a command-and-control domain, IP:port pairs, and a related user-agent string. The article also advised defenders to monitor for an official Adobe patch and take interim mitigations.
On April 7, 2026, a security researcher disclosed that the Adobe Reader zero-day had been actively exploited in the wild. The disclosure described data theft via privileged Acrobat API abuse and warned of possible follow-on attacks including remote code execution.
A zero-day vulnerability in Adobe Reader was exploited in the wild starting at least in December 2025 via specially crafted PDF files with obfuscated JavaScript. The activity reportedly used Russian-language lures tied to the Russian oil and gas sector, indicating a targeted campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
gist.github.com
Open sourcecyberwarzone.com
Open sourceborncity.com
Open sourcegist.github.com
Open sourcetechrepublic.com
Open sourcesophos.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting an unpatched **Adobe Reader/Acrobat zero-day** through malicious PDF files that trigger when a victim simply opens the document. Research from EXPMON says the exploit has been used since at least December and works against the latest Reader versions, abusing Acrobat JavaScript and internal APIs including `util.readFileIntoStream` and `RSS.addFeed` to bypass sandbox protections, read local files, fingerprint the host, and exfiltrate data to attacker-controlled infrastructure. The malicious PDFs reportedly contain hidden Base64-encoded objects and can fetch additional encrypted JavaScript payloads when a target matches attacker criteria, creating a path to follow-on attacks such as **remote code execution** or sandbox escape. Analysts said some lures were written in Russian and themed around developments in the Russian oil and gas sector. Adobe was notified through responsible disclosure, but no patch was available at the time of reporting; defenders were urged to avoid untrusted PDFs and monitor or block traffic to **`169.40.2.68:45191`** and HTTP/HTTPS requests using the **`Adobe Synchronizer`** User-Agent string.
Jun 29, 2026
German authorities issued security advisories for **Adobe Acrobat DC**, **Acrobat Reader DC**, and **Adobe Acrobat Reader** covering multiple vulnerabilities that could allow **information disclosure** and **arbitrary code execution**. One advisory specifically warned that a flaw in Adobe Acrobat Reader could expose sensitive information and be leveraged for code execution, raising the risk of compromise when users open maliciously crafted PDF files. A follow-up advisory expanded the scope to **multiple vulnerabilities** across Adobe’s Acrobat product line, indicating broader exposure for enterprise and end-user systems that rely on Adobe PDF software. Organizations using affected Adobe applications should prioritize vendor patches and review endpoint protections, as successful exploitation could give attackers access to data or the ability to run code on targeted systems.
Jun 29, 2026
JPCERT/CC warned that multiple vulnerabilities in **Adobe Acrobat** and **Adobe Acrobat Reader** could lead to arbitrary code execution on both Windows and macOS, including flaws tracked in Adobe bulletins `APSB26-43` and `APSB26-44`. Adobe said exploitation of the `APSB26-43` issues has been confirmed, while JPCERT/CC noted it had not observed attacks in Japan at publication time and cautioned that broader abuse could follow as technical details spread. The affected products include **Adobe Acrobat DC Continuous**, **Adobe Acrobat Reader DC Continuous**, and **Adobe Acrobat 2024 Classic** up to the vulnerable versions identified by Adobe. JPCERT/CC urged organizations and users to update immediately to the latest patched releases, including `26.001.21431` for the DC Continuous branch and `24.001.30365` for Acrobat 2024 Classic, because opening maliciously crafted content may be enough to trigger remote code execution.
Jun 29, 2026