Security readout for executives and security teams
Plain-English summary
A malicious document could cause vulnerable Adobe Acrobat software to reveal limited sensitive information from the current user's context. The issue is not remotely exploitable by itself; a user must open a malicious file. Business risk is mainly phishing-driven data exposure on endpoints running affected versions.
Executive priority
Treat this as a standard endpoint patching item, not an emergency, unless many users handle untrusted PDFs or affected Adobe versions remain widespread. The required user interaction lowers urgency, but document-based phishing keeps the exposure operationally relevant.
Technical view
CVE-2021-21060 is an improper input validation/improper file parsing flaw in Adobe Acrobat Pro DC versions 2020.013.20074 and earlier, 2020.001.30018 and earlier, and 2017.011.30188 and earlier. CVSS 3.1 score is 4.6 with user interaction required and low confidentiality impact.
Likely exposure
Exposure is most likely on workstations where users open PDF files with affected Adobe Acrobat or Acrobat Reader installations. The supplied data names Acrobat Pro DC versions and also lists Acrobat Reader with unspecified versions, so inventory should check both product lines against Adobe guidance.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. Exploitation requires a victim to open a malicious file, making phishing, file sharing, or drive-by document delivery the plausible context. Do not treat this as confirmed exploited based on the supplied evidence.
Researcher notes
Supplied metadata has a product inconsistency: the description names Acrobat Pro DC, while the affected entry lists Acrobat Reader with unspecified versions. The description says unauthenticated attacker, while the CVSS vector includes PR:L. Validate against Adobe APSB21-09 before final scoping.
Mitigation direction
- Apply Adobe updates referenced in APSB21-09 for affected Acrobat and Reader installations.
- Inventory endpoints for Acrobat Pro DC and Reader versions matching the affected ranges.
- Prioritize systems handling external PDFs, legal documents, support files, or customer submissions.
- Use mail and web controls to reduce delivery of untrusted PDF files.
- Check Adobe guidance for fixed versions if local package data is unclear.
Validation and detection
- Confirm installed Acrobat versions are newer than the affected version thresholds.
- Review software management records for successful Adobe update deployment.
- Sample high-risk endpoints and verify the application version directly.
- Check vulnerability scanner findings for CVE-2021-21060 closure.
- Confirm user-facing PDF handling workflows route untrusted files through controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-21060 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L1.52.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.6MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://helpx.adobe.com/security/products/acrobat/apsb21-09.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.