CVE-2026-34621 IBM QRadar · QRadar

Detect Adobe Acrobat and Reader Prototype Pollution Vulnerability (CVE-2026-34621) in IBM QRadar

Detects exploitation of CVE-2026-34621, a prototype pollution vulnerability (CWE-1321) in Adobe Acrobat and Reader. This KEV-listed vulnerability allows attackers to manipulate JavaScript object prototypes within PDF processing, potentially leading to arbitrary code execution, privilege escalation, or sandbox escape. Exploitation typically occurs via malicious PDF documents that trigger prototype chain manipulation during rendering or form processing.

MITRE ATT&CK

Tactic
Initial Access Execution Defense Evasion

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "processname" AS child_process,
  "parentprocessname" AS parent_process,
  "commandobject" AS command_line,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND "parentprocessname" ILIKE ANY ('%AcroRd32.exe%', '%Acrobat.exe%', '%AdobeCollabSync.exe%')
  AND "processname" ILIKE ANY ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%cscript.exe%', '%mshta.exe%', '%regsvr32.exe%', '%rundll32.exe%', '%certutil.exe%', '%bitsadmin.exe%')
  AND LOGSOURCETIME(devicetime) > NOW() - 7 DAYS
ORDER BY devicetime DESC
LIMIT 1000
critical severity medium confidence

QRadar AQL query identifying Adobe Acrobat and Reader processes spawning commonly abused living-off-the-land binaries (LOLBins), a primary indicator of CVE-2026-34621 prototype pollution exploitation.

Data Sources

IBM QRadarWindows Security Event LogSysmon

Required Tables

events

False Positives & Tuning

  • Legitimate Acrobat JavaScript automating document conversion tasks that invoke cmd.exe
  • Enterprise helpdesk tools triggering Acrobat with post-processing scripts
  • Adobe Acrobat accessibility features launching helper utilities

Other platforms for CVE-2026-34621

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Acrobat Prototype Pollution Child Process Spawn (Windows)

    Expected signal: Sysmon Event ID 1: Process Create with ParentImage matching AcroRd32.exe and Image matching cmd.exe; DeviceProcessEvents in MDE showing the parent-child relationship

  2. Test 2Simulate Acrobat JavaScript Prototype Pollution Payload (PDF)

    Expected signal: File creation event for .js file in temp directory; if embedded in PDF and opened in Acrobat, Sysmon Event ID 11 file create events and JavaScript engine activity

  3. Test 3Simulate Acrobat-Initiated Outbound Network Connection (C2 Beacon Pattern)

    Expected signal: Sysmon Event ID 3: Network connection from AcroRd32.exe to 127.0.0.1:4444; DeviceNetworkEvents in MDE showing Acrobat making a connection to port 4444

  4. Test 4Acrobat Suspicious File Drop in AppData (Post-Exploitation Staging)

    Expected signal: Sysmon Event ID 11: File created at %APPDATA%\adobe_helper.exe with Image matching AcroRd32.exe; DeviceFileEvents in MDE with InitiatingProcessFileName = AcroRd32.exe and FolderPath in AppData

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the user and endpoint involved; determine if the PDF that triggered the event is known-good, received via email, or downloaded from an external source. Pull the originating email headers or browser download history.
  2. Retrieve the SHA256 hash of the PDF file and the Acrobat process binary. Submit to VirusTotal, MalwareBazaar, and your internal sandbox — check for known malicious PDF indicators or prototype pollution payloads.
  3. Examine the full process tree: capture parent, child, and grandchild processes. Determine if any LOLBins were used for execution, persistence installation (registry run keys, scheduled tasks), or lateral movement.
  4. Check endpoint EDR telemetry for any file drops in %APPDATA%, %TEMP%, or %PUBLIC% by the Acrobat process. Identify any DLLs, executables, or scripts written post-PDF-open.
  5. Review outbound network connections initiated by Acrobat or its child processes. Flag any connections to non-Adobe IP ranges, especially on non-standard ports or to domains registered within the last 30 days.

Containment

  1. Immediately isolate the affected endpoint from the network using your EDR console (CrowdStrike: Network Containment; Defender: Isolate Device). Preserve volatile memory before isolation if forensics are required.
  2. Revoke active user sessions for the affected account and rotate credentials if credential harvesting is suspected based on child process activity (e.g., LSASS access, credential dumping tools).
  3. Block the identified malicious PDF hash at the email gateway, web proxy, and endpoint using threat intelligence platforms. If a C2 IP or domain was identified, null-route or sinkhole it at the perimeter firewall.

Evidence Collection

  1. Capture a full memory image of the affected endpoint using a forensically sound tool (e.g., WinPMem, Magnet RAM Capture) before any remediation. Memory may contain unpacked shellcode, prototype pollution artifacts, or injected code.
  2. Collect the malicious PDF and preserve it with chain of custody. Extract embedded JavaScript from the PDF using tools such as pdf-parser.py or peepdf to identify the prototype pollution payload and any encoded second-stage.
  3. Export endpoint telemetry logs: Sysmon events (ID 1, 3, 7, 11), Windows Security logs (4688, 4663), and CrowdStrike or Defender event logs covering the window from PDF open to detection. Preserve in read-only format.

Escalation Criteria

  • !Escalate to Incident Response if lateral movement is confirmed — e.g., Acrobat child processes making SMB connections, PsExec usage, or WMIC remote execution against other hosts.
  • !Escalate immediately if LSASS memory access (Sysmon Event ID 10) or credential dumping tools (Mimikatz, ProcDump targeting LSASS) are observed in the process chain following Acrobat exploitation.
  • !Escalate if multiple endpoints across the organization show the same pattern within a short window, suggesting a phishing campaign or watering-hole attack distributing CVE-2026-34621 exploits at scale.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Malicious PDF file in user Downloads, Desktop, or Temp directories — preserve original with metadata intact
  • >Sysmon Event ID 1 logs showing AcroRd32.exe or Acrobat.exe as parent of LOLBin processes
  • >Windows Prefetch entries for LOLBins (cmd.exe, powershell.exe) with timestamps correlated to Acrobat execution
  • >Registry run keys or scheduled tasks created during the attack window (HKCU\Software\Microsoft\Windows\CurrentVersion\Run)
  • >Network flow logs showing Acrobat or spawned child processes making external connections
  • >JavaScript extracted from the PDF — look for __proto__, constructor.prototype, or Object.assign patterns indicative of prototype pollution

Tuning Guidance

Begin by establishing a baseline of legitimate Acrobat child processes in your environment — many enterprises use Acrobat JavaScript for forms automation, print workflows, or document conversion. Whitelist known-good parent command lines (e.g., specific Acrobat batch processing scripts with static arguments) rather than whitelisting the parent process broadly. Tune the network detection component by excluding known Adobe CDN ranges (mask.icloud.com, acrobat.adobe.com, ardownload2.adobe.com) from triggering on port 443 connections. For the file drop detection, exclude Adobe's own update staging directories (e.g., %ProgramData%\Adobe\ARM) from scope. Consider adding a minimum process lifetime threshold (e.g., Acrobat must be open > 30 seconds before spawning a child) to reduce false positives from legitimate quick-launch PDF processing. Increase confidence scoring when multiple indicators co-occur: suspicious child process AND network connection AND file drop within the same session window.

Hunting Queries

Threat hunt query to identify historical or low-frequency Adobe Acrobat child process spawning events across the environment — surfaces infected hosts that may have evaded initial detection, and identifies unique command-line patterns for IOC extraction.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ('AcroRd32.exe', 'Acrobat.exe')
| where FileName in~ ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe')
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count(), Hosts=dcount(DeviceName) by FileName, InitiatingProcessCommandLine
| where Hosts > 1
| order by EventCount desc
Hunting — SPL
spl 
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(ParentImage, "(?i)(AcroRd32\.exe|Acrobat\.exe)")
| where match(Image, "(?i)(cmd\.exe|powershell|wscript|cscript|mshta|regsvr32|rundll32)")
| stats count by host, Image, CommandLine, ParentCommandLine
| where count > 1
| sort - count

Hunt for executable or script files dropped by Adobe Acrobat processes into writable user-space directories — identifies staged payloads associated with second-stage delivery after CVE-2026-34621 exploitation.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ('AcroRd32.exe', 'Acrobat.exe')
| where FileName endswith '.exe' or FileName endswith '.dll' or FileName endswith '.ps1' or FileName endswith '.vbs'
| where FolderPath has_any (@'\AppData\', @'\Temp\', @'\Public\')
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc
Hunting — SPL
spl 
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(Image, "(?i)(AcroRd32\.exe|Acrobat\.exe)")
| where match(TargetFilename, "(?i)(\.exe|\.dll|\.ps1|\.vbs|\.js)")
| where match(TargetFilename, "(?i)(AppData|Temp|Public)")
| table _time, ComputerName, User, Image, TargetFilename, MD5
| sort - _time

Atomic Red Team Tests

Test 1 Simulate Acrobat Prototype Pollution Child Process Spawn (Windows)
windows

Simulates the post-exploitation behavior of CVE-2026-34621 by launching cmd.exe as a child of a renamed Acrobat process stub. Tests whether the detection fires on parent-child process relationship.

Command

powershell 
# Lab only — simulate Acrobat spawning cmd.exe
$AcrobatStub = "$env:TEMP\AcroRd32.exe"
Copy-Item "C:\Windows\System32\notepad.exe" $AcrobatStub
Start-Process $AcrobatStub -PassThru | ForEach-Object { Start-Process cmd.exe -ArgumentList '/c whoami > $env:TEMP\acrobat_test_output.txt' }

Cleanup

powershell 
Remove-Item "$env:TEMP\AcroRd32.exe" -Force -ErrorAction SilentlyContinue; Remove-Item "$env:TEMP\acrobat_test_output.txt" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create with ParentImage matching AcroRd32.exe and Image matching cmd.exe; DeviceProcessEvents in MDE showing the parent-child relationship

Expected Detection

CVE-2026-34621 KQL and SPL rules should fire on the parent-child relationship between AcroRd32.exe and cmd.exe

Test 2 Simulate Acrobat JavaScript Prototype Pollution Payload (PDF)
windows

Creates a test PDF with a benign JavaScript payload that exercises prototype pollution patterns (__proto__ manipulation) without executing malicious code, to test sandbox detection and PDF analysis tooling.

Command

powershell 
# Lab only — requires Python and pypdf or reportlab
python3 -c "
import subprocess, os, tempfile
pdf_js = '''var obj = {}; obj.__proto__.polluted = 'CVE-2026-34621-TEST'; app.alert('Prototype pollution test - benign');'''
with open(os.path.join(tempfile.gettempdir(), 'cve_2026_34621_test.js'), 'w') as f:
    f.write(pdf_js)
print('Test JS payload written to temp dir for PDF embedding test')
"

Cleanup

powershell 
python3 -c "import os, tempfile; os.remove(os.path.join(tempfile.gettempdir(), 'cve_2026_34621_test.js'))" 2>/dev/null || true

Expected Telemetry

File creation event for .js file in temp directory; if embedded in PDF and opened in Acrobat, Sysmon Event ID 11 file create events and JavaScript engine activity

Expected Detection

PDF sandbox analysis tools should flag __proto__ and prototype chain manipulation patterns; endpoint file monitoring should detect JavaScript file creation by Acrobat

Test 3 Simulate Acrobat-Initiated Outbound Network Connection (C2 Beacon Pattern)
windows

Tests network detection rules by simulating outbound connections from a process named AcroRd32.exe to a non-standard port, mimicking C2 callback behavior after successful exploitation.

Command

powershell 
# Lab only — start a local listener first, then simulate Acrobat network call
$AcrobatStub = "$env:TEMP\AcroRd32.exe"
Copy-Item "C:\Windows\System32\notepad.exe" $AcrobatStub
# Start listener in background (requires ncat or PowerShell)
Start-Job { python3 -m http.server 4444 }
Start-Sleep 2
# Simulate connection from stub
Start-Process $AcrobatStub
Start-Sleep 1
Invoke-WebRequest -Uri 'http://127.0.0.1:4444' -UseBasicParsing -TimeoutSec 5 2>$null

Cleanup

powershell 
Stop-Job * -ErrorAction SilentlyContinue; Remove-Job * -ErrorAction SilentlyContinue; Remove-Item "$env:TEMP\AcroRd32.exe" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 3: Network connection from AcroRd32.exe to 127.0.0.1:4444; DeviceNetworkEvents in MDE showing Acrobat making a connection to port 4444

Expected Detection

KQL and SPL network detection components should fire on Acrobat process connecting to port 4444

Test 4 Acrobat Suspicious File Drop in AppData (Post-Exploitation Staging)
windows

Simulates the file staging behavior observed after CVE-2026-34621 exploitation, where the Acrobat process drops a second-stage executable into the user's AppData directory.

Command

powershell 
# Lab only — simulate file drop by Acrobat stub
$AcrobatStub = "$env:TEMP\AcroRd32.exe"
Copy-Item "C:\Windows\System32\notepad.exe" $AcrobatStub
$DropPath = "$env:APPDATA\adobe_helper.exe"
Start-Process $AcrobatStub -PassThru | ForEach-Object { Copy-Item 'C:\Windows\System32\calc.exe' $DropPath }

Cleanup

powershell 
Remove-Item "$env:TEMP\AcroRd32.exe" -Force -ErrorAction SilentlyContinue; Remove-Item "$env:APPDATA\adobe_helper.exe" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11: File created at %APPDATA%\adobe_helper.exe with Image matching AcroRd32.exe; DeviceFileEvents in MDE with InitiatingProcessFileName = AcroRd32.exe and FolderPath in AppData

Expected Detection

File drop hunting queries should surface the executable written to AppData by the Acrobat stub process

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0005Defense Evasion

Related Techniques

T1566.001Spearphishing AttachmentT1203Exploitation for Client ExecutionT1055Process InjectionT1059.001PowerShell

Same Tactic: Initial Access

Popular Detections