Is CVE-2023-21608 (Adobe Acrobat and Reader Use-After-Free) being exploited in the wild?

Yes. CISA added CVE-2023-21608 to its Known Exploited Vulnerabilities catalogue on 10 October 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.

What exploitation in the wild means for this CVE

CVE-2023-21608 is not just a theoretical Adobe Acrobat and Reader bug, it has been treated as actively exploited by CISA. For practitioners, that means the question is no longer whether the flaw can be weaponised, but whether any endpoint, document workflow, or user population is still exposed to delivery of a malicious PDF or embedded object that can trigger code execution.

Because this is a use-after-free with user-context execution, the practical concern is not only initial compromise but also what a successful document open can enable next. If a user launches the file with elevated access, broad network reach, or access to sensitive data, the impact can extend well beyond the reader process itself.

How to confirm exposure and reduce the attack surface

The first step is to identify where Acrobat and Reader are installed, where they are permitted to open untrusted files, and whether update enforcement is actually working. For version and patch details, use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog rather than relying on informal advisories or cached inventory records.

Prioritise any system that regularly handles inbound documents from email, web downloads, customer uploads, legal intake, or shared drives. Those are the places where exploitation pressure is highest, and they are the systems most likely to justify emergency remediation rather than routine patch scheduling.

Where available, pair local software inventory with telemetry from endpoint management and security tooling so you can see not just whether Adobe is installed, but whether the vulnerable application is actually used to open externally sourced content. A vulnerable product that is never reachable is still a governance issue, but it is not the same operational priority as a user-facing document viewer on a high-trust workstation.

For broader triage discipline, the Zero-Day and Exploited Vulnerabilities Guide is useful because it frames KEV-listed issues as response problems, not just patching tasks, and the Vulnerability Management Guide gives a practical model for prioritisation, exceptions and verification.

The underlying weakness class also matters. Adobe’s issue sits in the same family of memory-safety defects that often lead to arbitrary code execution, so the CWE Top 25 Guide helps teams explain why this kind of bug deserves immediate attention even when a change window is tight.

What to do if patching has to wait

If remediation is delayed, reduce the number of places where the application can be reached from untrusted content. That means constraining document open paths, tightening email and download handling, and restricting who can open externally sourced PDFs on endpoints that have access to sensitive systems or admin tooling.

Temporary compensating controls should focus on exposure reduction, not on wishful detection alone. Mark the exception explicitly, time-bound it, and make the business owner accountable for the decision to keep a known exploited vulnerability in place.

Monitor for signs of exploit delivery as well as post-exploit behaviour. Suspicious document launches, unexpected child processes from the reader, crash patterns around PDF handling, and unusual outbound connections from the application host are all worth attention when a KEV-listed CVE is under active exploitation.

When a device has handled suspicious content before remediation, treat it as a potential compromise candidate and investigate the surrounding user session, recent downloads, and any credentials or tokens accessible from that workstation. A document exploit is often only the first step in a broader intrusion sequence.

Risk and Threat Considerations

Actively exploited document-viewer flaws are attractive because they combine broad reach with routine user behaviour. Attackers do not need a complex initial access path if they can deliver a malicious PDF to a mailbox, portal, or browser download flow that users already trust.

Failure mechanism: A use-after-free can give the attacker execution in the context of the current user when crafted content drives the application into unsafe memory access, which is why document parsing bugs remain a common route to code execution.

Impact: The immediate effect can be malware execution, but the larger risk is foothold creation on endpoints that already hold browser sessions, file access, or access to internal services, making follow-on credential theft or lateral movement easier.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Active exploitation requires identifying vulnerable software exposure across the fleet.
	PR.PS-04 — System and Software Patching	The question centers on an actively exploited software vulnerability requiring patching.
	DE.CM-08 — Vulnerability Scans	Exposure confirmation depends on finding affected installations and missed remediation.
Recommendation — Inventory Adobe deployments and rank exposed endpoints for immediate remediation. Apply the vendor fix and verify the update reached every exposed workstation. Run authenticated scans to confirm where the vulnerable reader remains installed.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV-listed exploitation makes vulnerability monitoring and exposure verification essential.
	SI-2 — Flaw Remediation	An exploited Acrobat/Reader flaw requires timely remediation and controlled exceptions.
Recommendation — Continuously scan for vulnerable Adobe installations and track remediation status. Patch or mitigate the flaw promptly and document any temporary exception.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes rapid identification and prioritisation of vulnerable assets necessary.
Recommendation — Prioritise KEV-listed vulnerabilities and validate remediation on all exposed assets.

Practitioner Guidance

What to prioritise: Treat this as a fleet exposure and user-reachability problem first, not just a patch ticket. The most urgent systems are those that open untrusted PDFs and those used by privileged or high-trust users.

What to verify: Confirm that the fix is actually deployed, that vulnerable installations are not lingering on unmanaged endpoints, and that your exception process distinguishes between a temporary delay and an accepted risk that now has executive ownership.

Decision rule: If a system can receive external documents and the vulnerable reader is installed, assume the exposure is material until proven otherwise. If suspicious files were opened before remediation, escalate to compromise assessment rather than limiting the response to software update validation.

Practitioner takeaway: KEV listing should change your operating posture immediately, because active exploitation turns a normal software bug into a response and containment problem.