Adobe CVE-2026-34621

Question

Hi,

Does WithSecure Server/Computer Protection Premium provide protection against the recently disclosed Adobe vulnerability CVE-2026-34621?

Kind regards,

HCV

Sethu Laks · Answer

Hi @HCV

Thanks for raising these follow‑up questions, here’s a brief overview of the current protection:

* Current detections (Capricorn / APC)
EXP/JS.Pdfka and HEUR/APC.Misc are generic exploit detections for malicious PDF/JavaScript behavior. Based on what we’ve seen so far, they do block known in‑the‑wild samples related to this vulnerability, but like any generic rule they can’t guarantee 100% coverage of all future variants.
* DeepGuard / behavior‑based protection

We already have behavior‑based protection for suspicious activity originating from Acrobat/Reader (child processes, code‑execution behavior, unusual outbound connections, etc.). This logic has been reviewed and tuned with this CVE’s exploit chain in mind, so post‑exploitation steps are covered as generic malicious behavior, not just by IOCs.
* Hydra engine / future coverage

A review is in progress to strengthen generic static and behavioral detections for malicious PDF/JS patterns used in this exploit (auto‑run JavaScript, hidden payload fields, heavy JS obfuscation). These improvements will be rolled out via upcoming database/engine updates. If needed, a dedicated CVE‑named detection may be added on top of the generic coverage.

HCV · Answer

Hi,

Thank you for the update,much appreciated.

I just have a few follow-up questions to better understand the current protection level:

* Are the current detections (Capricorn: EXP/JS.Pdfka and APC: HEUR/APC.Misc) confirmed to block "known in the wild" exploits related to CVE-2026-34621, or are they mainly generic detections that may not cover all variants?
* Has any DeepGuard or behavior based protection been specifically tuned for this vulnerability?
* Regarding the Hydra engine review  is there any estimated timeline for potential additional coverage or a dedicated detection?

Best regards,

HCV

Sethu Laks · Answer

Hi @HCV

Just to share an update from our backend team:

* We currently have detection coverage in place via:* Capricorn: EXP/JS.Pdfka
* APC: HEUR/APC.Misc

* However, this coverage was not available previously, which is part of what we’re reviewing.
* Our backend team is now checking internally whether additional coverage should be introduced through the Hydra engine. A follow-up ticket has been created on their side, and we’ll keep you updated as soon as we have more information.

Please let me know if you have any questions in the meantime.