Two critical flaws, both exploited in the wild
Two serious vulnerabilities are currently under active exploitation, affecting widely used software. Organisations running Adobe Acrobat Reader or the Marimo Python notebook framework should treat patching as urgent.
These are not theoretical risks. Attackers are already leveraging both flaws.
Adobe Acrobat Reader: CVE-2026-34621
Adobe has issued emergency updates for a critical vulnerability in Acrobat Reader. Tracked as CVE-2026-34621, the flaw carries a CVSS score of 8.6 out of 10.0. Successful exploitation allows an attacker to execute malicious code on an affected system.
Acrobat Reader remains one of the most common applications in enterprise environments. PDFs are everywhere, and users routinely open them without a second thought. That ubiquity makes this vulnerability particularly dangerous. An attacker only needs a crafted PDF and a user willing to open it.
Adobe's patch should be applied immediately across all endpoints where Acrobat Reader is installed.
Marimo: Pre-authentication Remote Code Execution
A separate critical vulnerability in Marimo, an open-source Python notebook framework, is also seeing active exploitation. This is a pre-authentication RCE flaw, meaning attackers do not need valid credentials to exploit it. Reports indicate it is being used for credential theft.
Marimo may not have the same profile as Adobe products, but it is used in data science and development workflows. If your teams use Marimo, particularly in environments accessible from the internet, the risk is significant. Pre-auth RCE is about as severe as vulnerabilities get.
What organisations should do now
- Patch Adobe Acrobat Reader across all managed endpoints. Use your endpoint management tooling to confirm coverage.
- Identify any Marimo instances in your environment, including shadow IT deployments by data or engineering teams. Update to a patched version immediately.
- Restrict network exposure for development tools like Marimo. They should never be directly accessible from the public internet without strong access controls.
- Review detection rules in your SIEM or EDR platform. Ensure you have coverage for post-exploitation behaviours such as credential dumping and lateral movement.
- Communicate the risk to your teams. Developers and analysts may not be aware their tools are being targeted.
Metaphor's perspective
These two vulnerabilities highlight a recurring pattern. Attackers target both the tools everyone uses (like PDF readers) and the tools that fly under the security team's radar (like open-source development frameworks). A solid vulnerability management programme needs to account for both.
At Metaphor, we help organisations build patching workflows that cover the full software estate, not just the obvious applications. If you are unsure whether your environment is exposed, or if your vulnerability management process has gaps, we can help you assess and close them.
Sources: Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 - The Hacker News, Critical Marimo pre-auth RCE flaw now under active exploitation - BleepingComputer