What Happened
Adobe Acrobat Reader — the PDF viewer installed on the vast majority of enterprise desktops worldwide — has been harbouring an actively exploited zero-day since at least November 2025. CVE-2026-34621 is a prototype pollution vulnerability triggered automatically when a user opens a crafted PDF. No macros, no additional clicks, no special permissions required. Adobe released an emergency patch on 13 April 2026, more than four months after exploitation began. CISA simultaneously added the CVE to its Known Exploited Vulnerabilities catalogue.
The attack works in stages: the malicious PDF contacts an attacker-controlled server, which fingerprints the victim’s system, then delivers tailored remote code execution and sandbox escape exploits to high-value targets. This staging means that automated sandboxes frequently saw benign-appearing PDFs — the harmful payload only arrived for selected victims.
Business Impact
The four-month window is the primary business risk. Any PDF opened in Acrobat Reader between November 2025 and today could have been a compromise vector. The categories of exposure include:
- Data breach: attackers with code execution in an Acrobat Reader process on an endpoint can access documents open in that session, stored locally, or reachable from that user’s credentials
- Credential theft: session tokens, cached passwords, and browser credentials are accessible from a compromised endpoint process
- Lateral movement: a compromised endpoint is a foothold into the wider network, particularly if the affected user had elevated privileges or network access to sensitive systems
Sectors most at risk are those with high inbound PDF volumes: legal, finance, insurance, procurement, healthcare, and HR functions where document review is a daily workflow.
Regulatory Implications
Under GDPR and NIS2, organisations that experienced a breach via this vector during the four-month window have notification obligations if personal data was accessed. The extended exploitation window complicates incident response: it may be difficult to determine with certainty whether any specific PDF opening event led to a compromise, which could force a conservative, broader notification posture.
ISO 27001-aligned organisations should log this as a near-miss or potential security event in their risk register and assess whether investigation is warranted.
Board-Ready Summary
- Adobe’s most widely installed PDF tool has been under silent attack since November 2025
- Opening any PDF could have triggered code execution — no user action beyond opening the file was required
- A patch is now available and must be deployed urgently across all managed desktops
- The business question is whether a retrospective investigation of the four-month window is warranted, given the potential for undetected data access
Recommended Actions
- Deploy the Adobe patch (APSB26-43) organisation-wide today — this is not a routine update, it is an emergency security fix for an actively exploited vulnerability
- Direct IT to confirm 100% patch coverage within 24 hours and report exceptions by asset to the security team
- Instruct threat hunting or security operations to review endpoint telemetry from November 2025 onwards for unusual child process activity from Acrobat Reader
- Brief the incident response team on the four-month exposure window — they should understand the scope of what may have occurred before commencing any investigation
- Consider legal counsel review of whether the exposure period triggers notification obligations under applicable data protection regulations