Detect Adobe Acrobat and Reader Prototype Pollution Vulnerability (CVE-2026-34621) in Microsoft Sentinel
Detects exploitation of CVE-2026-34621, a prototype pollution vulnerability (CWE-1321) in Adobe Acrobat and Reader. This KEV-listed vulnerability allows attackers to manipulate JavaScript object prototypes within PDF processing, potentially leading to arbitrary code execution, privilege escalation, or sandbox escape. Exploitation typically occurs via malicious PDF documents that trigger prototype chain manipulation during rendering or form processing.
MITRE ATT&CK
KQL Detection Query
let AcrobatProcesses = dynamic(['AcroRd32.exe', 'Acrobat.exe', 'AdobeCollabSync.exe']);
let SuspiciousChildProcs = dynamic(['cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'certutil.exe', 'bitsadmin.exe', 'wmic.exe']);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName has_any (AcrobatProcesses)
| where FileName has_any (SuspiciousChildProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, FileName, ProcessCommandLine, InitiatingProcessSHA256
| union (
DeviceFileEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName has_any (AcrobatProcesses)
| where FolderPath has_any (@'\AppData\Roaming', @'\Temp', @'\Public')
| where FileName endswith '.exe' or FileName endswith '.dll' or FileName endswith '.js' or FileName endswith '.vbs'
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, InitiatingProcessSHA256
)
| union (
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName has_any (AcrobatProcesses)
| where RemotePort in (80, 443, 8080, 4444, 1337)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessSHA256
)
| order by TimeGenerated descDetects Adobe Acrobat and Reader spawning suspicious child processes, writing executable files to writable directories, or making outbound network connections — all indicators of prototype pollution exploitation leading to code execution.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Adobe Acrobat plugins or extensions that spawn helper processes
- Enterprise PDF workflows that trigger scripted post-processing via Acrobat JavaScript
- Acrobat update mechanisms that download and execute installer components
- IT automation tools that invoke Acrobat for batch PDF generation with network callbacks
Other platforms for CVE-2026-34621
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Acrobat Prototype Pollution Child Process Spawn (Windows)
Expected signal: Sysmon Event ID 1: Process Create with ParentImage matching AcroRd32.exe and Image matching cmd.exe; DeviceProcessEvents in MDE showing the parent-child relationship
- Test 2Simulate Acrobat JavaScript Prototype Pollution Payload (PDF)
Expected signal: File creation event for .js file in temp directory; if embedded in PDF and opened in Acrobat, Sysmon Event ID 11 file create events and JavaScript engine activity
- Test 3Simulate Acrobat-Initiated Outbound Network Connection (C2 Beacon Pattern)
Expected signal: Sysmon Event ID 3: Network connection from AcroRd32.exe to 127.0.0.1:4444; DeviceNetworkEvents in MDE showing Acrobat making a connection to port 4444
- Test 4Acrobat Suspicious File Drop in AppData (Post-Exploitation Staging)
Expected signal: Sysmon Event ID 11: File created at %APPDATA%\adobe_helper.exe with Image matching AcroRd32.exe; DeviceFileEvents in MDE with InitiatingProcessFileName = AcroRd32.exe and FolderPath in AppData
Unlock Pro Content
Get the full detection package for CVE-2026-34621 including response playbook, investigation guide, and atomic red team tests.