CVE Watch28 ago 2026

CVE-2026-34621

Adobe Acrobat and Reader Prototype Pollution Vulnerability

CVSS

8.6

Alto

EPSS

7.1%

p94

KEV

SÍ

13 abr 2026

Exploit Today

0-100

Publicado: 11 abr 2026 · Última mod.: 28 ago 2026 · CWE-1321

EPSS · 30d

7.1%EPSS · 30 días7.1%

2026-08-022026-08-31

Ficha del catálogo KEV

Producto

Adobe / Acrobat and Reader

Vulnerabilidad

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Añadido a KEV

13 abr 2026

Remediar antes de

27 abr 2026

Uso conocido en ransomware

Descripción resumida

Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

Descripción técnica

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-822574.3 MED

10.5%

——3SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.6h CVE-2026-781817.3 ALT

36.6%

——11A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.5d CVE-2026-781807.3 ALT

36.6%

——11A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity.7d CVE-2026-781796.3 MED

25.5%

——8A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.7d CVE-2026-781787.3 ALT

36.6%

——11A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned".4d CVE-2026-782079.4 CRÍ

36.6%

——11exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.2d