CVE-2026-81997: Adobe Acrobat Authorization Bypass Vulnerability

CVE-2026-81997 Overview

Adobe Acrobat and Acrobat Reader contain an Incorrect Authorization vulnerability [CWE-863] that enables a security feature bypass. An attacker can leverage this flaw to circumvent security controls and gain unauthorized write access on affected systems. Exploitation requires user interaction: a victim must open a malicious PDF file crafted by the attacker. The vulnerability has a changed scope, meaning successful exploitation impacts resources beyond the vulnerable component's security authority. Adobe published this issue in security advisory APSB26-141, and it affects Acrobat and Acrobat Reader on both Microsoft Windows and Apple macOS platforms.

Critical Impact
Successful exploitation allows attackers to bypass authorization controls in Adobe Acrobat and gain unauthorized write access to system resources through a maliciously crafted PDF.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Adobe Acrobat on Microsoft Windows and Apple macOS

Discovery Timeline

2026-09-08 - CVE-2026-81997 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-81997

Vulnerability Analysis

The vulnerability stems from an Incorrect Authorization weakness in Adobe Acrobat and Acrobat Reader. The application performs an authorization check but does not enforce the intended security policy correctly. This inconsistency allows a crafted PDF to invoke actions the application should have restricted. The scope change indicates that exploitation affects resources beyond Acrobat's own security boundary, such as files or components managed by the operating system.

The integrity impact is rated High, while confidentiality and availability are not affected. An attacker who convinces a user to open a malicious file can write to locations that should be off-limits under normal security policy enforcement.

Root Cause

The root cause is classified as CWE-863: Incorrect Authorization. Adobe Acrobat evaluates a permission or trust decision using logic that does not correctly reflect the security policy for certain operations. When Acrobat processes a specific structure embedded in a PDF, the flawed authorization check permits an action that the sandbox or trust model should have blocked.

Attack Vector

The attack vector is Local and requires user interaction. A victim must open a malicious PDF using a vulnerable version of Adobe Acrobat or Acrobat Reader. Typical delivery paths include phishing emails with PDF attachments, malicious links to hosted PDFs, or PDFs staged on file shares. No privileges are required prior to exploitation. Because scope is changed, the resulting write access can extend beyond Acrobat's own trust boundary into the surrounding operating system context.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability remains low, reflecting limited observed exploitation activity at publication.

Detection Methods for CVE-2026-81997

Indicators of Compromise

Unexpected file writes by Acrobat.exe or AcroRd32.exe on Windows, or the AdobeAcrobat process on macOS, to directories outside the user's document paths.
PDF files delivered via email or web downloads that spawn child processes or trigger writes to protected system locations after being opened.
Modifications to Acrobat configuration files, trust manager settings, or JavaScript privilege lists shortly after a PDF is opened.

Detection Strategies

Deploy behavioral endpoint detection rules that flag Acrobat processes performing file writes to sensitive paths or altering security-related registry keys.
Correlate email gateway telemetry for inbound PDF attachments with subsequent endpoint activity from Acrobat processes to identify suspicious document-driven behavior.
Hunt for anomalous parent-child process relationships originating from Acrobat.exe or AcroRd32.exe, particularly writes performed via changed-scope operations.

Monitoring Recommendations

Monitor endpoint logs for Acrobat version strings and confirm that all managed installations align with the fixed release referenced in APSB26-141.
Enable and forward Windows Sysmon Event ID 11 (file create) and macOS Endpoint Security file-event telemetry for Acrobat processes to a central SIEM.
Alert on Acrobat writes to startup folders, scheduled task directories, and autorun registry keys.

How to Mitigate CVE-2026-81997

Immediate Actions Required

Inventory all Adobe Acrobat and Acrobat Reader installations across Windows and macOS endpoints and identify versions that predate the fix in APSB26-141.
Apply the vendor-supplied patches referenced in the Adobe Acrobat Security Advisory APSB26-141 as soon as change control allows.
Reinforce user awareness training to reject unexpected PDF attachments and validate senders before opening documents.

Patch Information

Adobe has released updates for both the Classic and Continuous tracks of Acrobat and Acrobat Reader. Administrators should consult the Adobe Acrobat Security Advisory APSB26-141 for exact fixed versions and download locations. Deploy the updates through Adobe's Remote Update Manager, Microsoft Intune, Jamf Pro, or an equivalent enterprise patch management platform.

Workarounds

Enable Adobe Acrobat Protected View for files originating from the internet and other untrusted locations to constrain PDF-triggered operations.
Restrict Acrobat JavaScript execution through the bDisableJavaScript registry policy on Windows or the equivalent macOS preference where compatible with business workflows.
Use application allow-listing and OS-level file integrity controls to block Acrobat from writing to sensitive system directories until patches are deployed.

bash

# Configuration example: disable Acrobat JavaScript via Windows registry
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f