CVE-2026-27290

CVE-2026-27290 is an Untrusted Search Path vulnerability affecting Adobe Framemaker versions 2022.8 and earlier that could allow attackers to execute arbitrary code in the context of the current user. The vulnerability stems from improper search path handling for critical resources, enabling attackers to redirect the application to malicious programs. This is a local vulnerability that requires no user interaction for exploitation. The vulnerability carries a CVSS v3.1 score of 8.6 (HIGH), with a local attack vector and low attack complexity. It requires no special privileges but does necessitate user rights context. The impact is severe, with potential for complete compromise of confidentiality, integrity, and system availability. The attack's reach extends beyond the vulnerable application scope. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community interest based on its very low EPSS score of 0.000270000. While no active exploitation has been documented, organizations running affected Framemaker versions should prioritize patching to mitigate the potential risk of local privilege escalation and code execution attacks.