CVE-2026-27221: Acrobat Reader | Improper Certificate Validation (CWE-295)

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-10 · updated 2026-08-28
Weakness: CWE-295

Description

Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to spoof the identity of a signer. Exploitation of this issue requires user interaction.

Affected products

Adobe Acrobat for Edge: from 24.001.20604 before 24.001.30356 — fixed in 24.001.30356
Adobe Acrobat DC: before 25.001.21288 — fixed in 25.001.21288
Adobe Acrobat Reader: before 25.001.21288 — fixed in 25.001.21288

How to fix

Upgrade to a fixed version: Adobe Acrobat for Edge 24.001.30356; Adobe Acrobat DC 25.001.21288; Adobe Acrobat Reader 25.001.21288. Check the vendor advisory for mitigations.

References

https://helpx.adobe.com/security/products/acrobat/apsb26-26.html

Get alerted when CVE-2026-27221 or the next vulnerability affects your stack