Advisories
JPCERT/CC Issues Alert for Critical Arbitrary Code Execution Flaws in Adobe Acrobat and Reader (APSB26-141)
JPCERT/CC has published an advisory regarding critical vulnerabilities in Adobe Acrobat and Reader across Windows and macOS platforms. Successful exploitation could allow an attacker to execute arbitrary code via malicious PDF content. Defenders must immediately apply the latest software updates provided by Adobe.
What happened
JPCERT/CC has issued a security alert warning of vulnerabilities affecting Adobe Acrobat and Reader software. If an attacker successfully tricks a user into opening specially crafted malicious content, they can achieve arbitrary code execution on the target system.
Impacted software
The flaws impact both Continuous and Classic deployment tracks running on Windows and macOS environments:
- Adobe Acrobat Continuous version 26.002.21900 and earlier
- Adobe Acrobat Reader Continuous version 26.002.21900 and earlier
- Adobe Acrobat 2024 Classic version 24.001.30383 and earlier
What to do
Sysadmins and security teams should prioritize updating all instances of Adobe Acrobat and Reader to the patched versions:
- Update Adobe Acrobat Continuous to version 26.002.21901 or later
- Update Adobe Acrobat Reader Continuous to version 26.002.21901 or later
- Update Adobe Acrobat 2024 Classic to version 24.001.30429 or later
Updates can be applied directly from within the application by navigating to Help and selecting Check for Updates, or by deploying standalone installers via enterprise management tools.
Related vulnerabilities
Adobe June 2026 Patch Tuesday: 11 Bulletins, 123 CVEs, CVSS 10.0 in Campaign Classic
Adobe released 11 security bulletins in June 2026, addressing 123 CVEs across multiple products. The highest severity CVSS 10.0 is in Campaign Classic, with other critical CVEs in ColdFusion and Acrobat Reader. Defenders should prioritize patching Campaign Classic first, then ColdFusion and Acrobat Reader, and monitor for exploitation.
Read briefing
Adobe April 2026 Patch Tuesday: 61 CVEs, 12 Bulletins, Critical Reader & ColdFusion Patches
Adobe released 12 security bulletins covering 61 CVEs across multiple products, with the most urgent patches for Acrobat Reader and ColdFusion. Defenders should apply these updates immediately and verify that vulnerable versions are no longer in use.
Read briefing
Adobe Acrobat Reader RCE Exploited – Patch Immediately
A remote code execution vulnerability in Adobe Acrobat Reader DC allows attackers to execute arbitrary code via a crafted PDF. The flaw is present in versions 22.x and earlier and has been actively exploited in the wild. Defenders should apply the latest patch, disable JavaScript in PDFs, and monitor for anomalous outbound connections.
Read briefing
Adobe Acrobat Reader DC Annotation Use-After-Free RCE Vulnerability (CVE-2026-81976)
A use‑after‑free flaw in Adobe Acrobat Reader DC’s annotation handling allows remote attackers to execute arbitrary code when a user opens a crafted PDF or visits a malicious web page. The vulnerability, CVE‑2026‑81976, carries a CVSS score of 7.8 and requires user interaction. Defenders should patch to the latest Reader version and monitor for suspicious PDF activity.
Read briefing