How do you patch or mitigate CVE-2023-26369 (Adobe Acrobat and Reader Out-of-Bounds Write)?

CISA’s required action for CVE-2023-26369 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Adobe Acrobat and Reader in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What this CVE means operationally

CVE-2023-26369 is a memory corruption issue in Adobe Acrobat and Reader, so the practical question is not just whether a patch exists, but whether every reachable installation can be updated or safely contained. For most estates, the right response is to treat it as an exposure management problem first, then verify that the vendor fix or mitigation actually landed on every endpoint.

Because the vulnerability sits in user-facing desktop software, exposure is usually broad: named users, shared workstations, VDI pools, and any system that opens untrusted PDF content. The decision point is whether the product is still needed, whether it can be updated quickly, and whether any host that cannot be updated can be isolated enough to remove the exploit path.

How to validate exposure and apply the fix

Start by finding every Acrobat and Reader installation, including old packages, side-loaded copies, and systems where the app remains installed but not obviously in use. Then verify the actual version and update channel on each system, because “present” does not always mean “patched,” especially where software deployment is fragmented or user-installed outside the standard build.

Use the vendor advisory as the source of truth for the exact update or mitigation path, and use the CISA Known Exploited Vulnerabilities Catalog to confirm that your remediation aligns with the current KEV expectation. For broader triage and prioritization, the Zero-Day and Exploited Vulnerabilities Guide and the Vulnerability Management Guide both support the same operational pattern: identify the asset, confirm exploitability, then drive emergency remediation to completion.

If the fix is available, deploy it through your normal software distribution path, but do not wait for the next routine cycle if the product is internet-reachable or handles untrusted documents. Where the software is business-critical, reduce friction by staging the update, validating it in a small ring, then expanding quickly once the package is proven stable.

When patching must wait, what containment actually helps

If you cannot immediately apply the vendor update or documented mitigation, the goal is to shrink exposure rather than pretend the risk has disappeared. The cleanest option is to remove internet exposure, stop browser handoff to the product where possible, and restrict who can open externally sourced PDFs on the affected system.

Patch Management Guide is useful here because it treats exceptions as time-bound, not permanent. That matters for CVEs like this one: if mitigation is delayed, you should document the exception owner, the compensating control, the expiry date, and the exact condition that ends the exception, such as successful deployment of the update or removal of the application.

In practice, the most useful temporary controls are application restriction, network containment, and minimizing exposure to untrusted content, not vague user warnings. If the vulnerable software is essential but cannot be remediated quickly, keep it off directly exposed systems where feasible and make sure the host is monitored closely for suspicious document handling or unexpected child processes.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This CVE response depends on finding and remediating vulnerable software quickly.
Recommendation — Prioritize, patch, and verify all affected Acrobat and Reader installations immediately.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue requires timely remediation of a known software flaw across the estate.
	CM-7 — Least Functionality	Temporary containment often means reducing or removing use of the affected application.
Recommendation — Track the flaw through remediation and confirm the fix is deployed everywhere. Disable or remove unnecessary Acrobat and Reader exposure until the fix is in place.
OWASP ASVS	V13 — Configuration	Containment depends on safe application and deployment configuration while remediation is pending.
Recommendation — Lock down the affected application configuration and restrict unsafe exposure paths.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	The subject is a remediation workflow for a known exploited vulnerability.
Recommendation — Drive the vulnerability through inventory, remediation, and verification without delay.

Practitioner Guidance

What to verify: Confirm that every Acrobat and Reader instance is either updated to the vendor-fixed state or covered by a documented mitigation that really changes exposure, not just policy language. Pay special attention to laptops, shared endpoints, VDI, and any machine where users can open external PDFs outside managed workflows.

Decision rule: If you can update quickly, patch first and validate afterward; if you cannot, treat the system as temporarily exposed and reduce its attack surface until the update is installed or the product is removed. Do not leave an exception open while waiting for a convenient maintenance window.

Practitioner takeaway: For an actively exploited or high-priority desktop application CVE, the right standard is complete coverage, not partial rollout, because one unpatched reader on one reachable endpoint is enough to preserve the attack path.