Netskope Threat Labs

FILE-PDF Adobe Acrobat Reader arbitrary code execution attempt

IPS-CFWIPS-SWG

1 SID: 66389

First seen
May 2026
Last seen
October 2026

Detects a PDF exploiting CVE-2026-34621, a flaw in Adobe Acrobat Reader's JavaScript engine that can allow code execution. The rule matches the obfuscated script construction that public exploits use to build and run malicious code inside the reader.