CVE-2021-21045 json
Acrobat Reader DC Improper Installer Access Control Vulnerability Could Lead To Privilege Escalation
published 2021-02-11 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8436
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an improper access control vulnerability. An unauthenticated attacker could leverage this vulnerability to elevate privileges in the context of the current user.
Patch / fix
- adobe acrobat_dc 20.013.20074
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.78% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- Adobe Acrobat Reader
- adobe acrobat_reader_2017
- adobe acrobat_2017
- adobe acrobat_reader_2020
- adobe acrobat_2020
- adobe acrobat_reader_dc
- adobe acrobat_dc
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
helpx.adobe.com
/security/products/acrobat/apsb21-09.html
vendor-advisory
Sources
- CVE List CVE-2021-21045
- NVD CVE-2021-21045
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.