CVE-2026-81996: 
Adobe Acrobat Reader Continuous vulnerability analysis and mitigation

CVE-2026-81996 is an Incorrect Authorization (CWE-863) vulnerability in Adobe Acrobat Reader and Adobe Acrobat that enables local privilege escalation. A low-privileged attacker can exploit this flaw to gain elevated access without requiring user interaction, and the scope change indicates impact beyond the vulnerable component itself. Affected products include Adobe Acrobat and Acrobat Reader (versions 26.002.21900 and earlier on Windows and macOS) and Acrobat 2024 (versions 24.001.30383 and earlier). The vulnerability was disclosed and patched on September 8, 2026, with a CVSS v3.1 base score of 8.8 (High) (Adobe Advisory, GitHub Advisory).

The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the application performs an authorization check when an actor attempts to access a resource or perform an action, but does not correctly execute that check. The attack vector is local, requiring low privileges and no user interaction, with low attack complexity — making it straightforward to exploit for any authenticated local user. The changed scope metric indicates that a successful exploit can affect resources or components beyond the security boundary of the vulnerable Acrobat process itself, potentially impacting the underlying operating system. No public technical write-ups or proof-of-concept code have been identified at this time (Adobe Advisory, GitHub Advisory).

Successful exploitation results in high impact to confidentiality, integrity, and availability, with the potential for complete system compromise. A low-privileged local user can bypass authorization controls to gain elevated access, potentially enabling unauthorized data access, modification of system files, or disruption of services. The changed scope indicates that the attacker's elevated privileges may extend beyond the Acrobat application to affect other system components or resources on the host (Adobe Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Adobe Advisory). The EPSS score is approximately 0.131% (3rd percentile), indicating a currently low probability of exploitation within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Adobe has released patched versions addressing this vulnerability. Users should update to the following fixed versions: Adobe Acrobat and Acrobat Reader (Continuous track) version 26.002.21901 or later, and Acrobat 2024 (Classic track) version 24.001.30429 or later, on both Windows and macOS. No configuration-based workarounds have been published; upgrading to a patched version is the recommended remediation. Organizations should prioritize patching systems where low-privileged users have local access to affected Acrobat installations (Adobe Advisory).

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in Adobe products that could allow for arbitrary code execution, referencing this and related September 2026 Adobe patches. Coverage has been aggregated by standard vulnerability tracking platforms including VulDB, CVEFeed, and AusCERT. No notable independent researcher commentary or significant social media discussion has been identified beyond routine vulnerability disclosure channels.