Intune Proactive Remediation – Adobe Acrobat/Reader Version Enforcement (CVE-2026-34621)

This repository contains Microsoft Intune Proactive Remediation scripts to reduce exposure to Adobe Acrobat/Reader vulnerabilities by:

1. Enforcing a minimum patched version (detect outdated builds and remove them).
2. Immediately reducing attack surface by disabling Acrobat/Reader JavaScript via policy registry keys.

These controls can be used together:

• Short-term mitigation: disable JavaScript to reduce risk immediately.
• Long-term fix: enforce patched versions (and remove legacy installations).

---

Why this exists (security context)

Adobe released a security update for Acrobat and Reader addressing CVE‑2026‑34621, which Adobe confirmed is being exploited in the wild, and which can lead to arbitrary code execution. The fixed version for the Acrobat/Reader DC Continuous track is 26.001.21411. 1

In managed environments, having the latest installer available is not enough—devices may still run older builds. This repository helps ensure vulnerable versions are not left installed and enables an additional mitigation (disabling JavaScript) to reduce exposure immediately.

---

Contents

A) Version Enforcement (Detect outdated / Remove legacy)

• Detect-AdobeAcrobat.ps1
• Remediate-AdobeAcrobat.ps1

B) Immediate Mitigation (Disable JavaScript in Acrobat/Reader DC)

• DetectionJavaScript.ps1
• RemediateJavaScript.ps1

---

A) Version Enforcement scripts

1) Detection: Detect-AdobeAcrobat.ps1

Purpose: Detect Adobe Acrobat installations below a defined minimum version.

Behavior:

• Checks both uninstall registry hives (64-bit and 32-bit):
  • HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  • HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
• Matches products where DisplayName is like Adobe Acrobat*
• Compares DisplayVersion against:
  • Minimum version: 26.001.21411 (patched build for CVE‑2026‑34621) 1

Exit codes:

• 0 = Compliant (not found OR version >= minimum)
• 1 = Non-compliant (found with a lower version)

2) Remediation: Remediate-AdobeAcrobat.ps1

Purpose: Remove Adobe Acrobat installations found on the device (Reader/Pro/Standard).

Behavior:

• Finds Adobe Acrobat* entries in both uninstall registry hives
• Extracts MSI product GUID via:
  • UninstallString / QuietUninstallString regex (preferred)
  • fallback: registry key name
• Runs:
  • msiexec /x {GUID} /q /norestart
• Treats 3010 (reboot required) as success

Exit codes:

• 0 = Remediation completed successfully
• 1 = Remediation completed with errors

Note: This remediation removes Acrobat. Make sure you also deploy the patched version (or preferred supported version) via your standard Intune application deployment process.

---

B) Immediate mitigation scripts (Disable JavaScript)

Disabling Acrobat/Reader JavaScript can reduce exposure to malicious PDF payloads that rely on JavaScript execution. This is meant as a rapid risk reduction measure while patching is being rolled out.

1) Detection: DetectionJavaScript.ps1

Purpose: Verify that JavaScript is disabled for both Adobe Reader DC and Adobe Acrobat DC.

Registry keys checked:

• HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\bDisableJavaScript
• HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\bDisableJavaScript

Expected value:

• bDisableJavaScript = 1

Exit codes:

• 0 = Compliant (both keys exist and are set to 1)
• 1 = Non-compliant (missing key and/or not set to 1)

2) Remediation: RemediateJavaScript.ps1

Purpose: Enforce JavaScript disablement for both Reader and Acrobat DC by setting policy registry values.

Behavior:

• Creates the registry path(s) if missing
• Sets:
  • bDisableJavaScript (DWORD) = 1
• Exits with 1 on any error; otherwise 0

---

Recommended Intune setup

Option 1 (Recommended): Use BOTH remediations

1. Mitigation package: Disable JavaScript (fast reduction of attack surface)
2. Patch enforcement package: Version enforcement (removes legacy/vulnerable installs)

This approach gives immediate hardening while you ensure the patched version is deployed everywhere.

Configuration tips

• Run scripts as System (recommended).
• Start with a higher frequency during incident response (e.g., every 1–4 hours), then reduce.

---

Operational notes / impact

Disabling JavaScript may affect functionality

Some PDFs or enterprise workflows (forms, dynamic content, embedded scripts) can rely on JavaScript. Validate with key user groups before broad rollout.

Uninstall remediation requires MSI GUID

If Acrobat was installed via non-MSI methods, GUID-based removal may fail and require a different uninstall strategy.

---

References

• Adobe Security Bulletin: APSB26‑43 – Acrobat/Reader update fixing CVE‑2026‑34621 (patched in 26.001.21411) 1

---

License

This project is licensed under the MIT License — feel free to use, modify and distribute.

Disclaimer
This repository contains generic, public best-practice scripts. It is not affiliated with any current or past employer or client. Created for educational and community purposes only.