Hackers Target Adobe Reader Users With Sophisticated Zero

Gbhackers •Divya • April 8, 2026

Security researchers at EXPMON have uncovered a highly sophisticated, unpatched zero-day vulnerability actively targeting Adobe Reader users. The exploit, first detected in the wild late last month, allows threat actors to silently steal local files, gather sensitive system information, and potentially deploy remote code execution (RCE) attacks against compromised machines. According to the threat intelligence […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Zero-Day Exploit Targeting Adobe Reader Users A zero-day vulnerability in Adobe Reader has been actively exploited since at least December 2025, allowing attackers to execute remote code and steal sensitive data through malicious PDF files. Security researcher Haifei Li identified the exploit, which does not require user interaction beyond opening a PDF document. The exploit leverages a memory corruption flaw and utilizes sophisticated techniques to evade detection, including in-memory execution and obfuscation. Attackers have been observed using Russian-language lures related to the oil and gas industry to target victims. The vulnerability affects the latest version of Adobe Reader, and organizations are advised to refrain from opening untrusted PDF files until a patch is released. Adobe has been notified of the issue, but no patch has been issued as of the latest reports. The exploit's sophistication suggests potential involvement from well-resourced threat actors, possibly nation-state linked. 49 sources 76

Extracted Entities

Hackers Target Adobe Reader Users With Sophisticated Zero

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)