CVE-2026-27290
Untrusted Search Path in Adobe FrameMaker Allows Code Execution
Publication date: 2026-04-14
Last updated on: 2026-04-15
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | framemaker | to 2022.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-426 | The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker could execute arbitrary code with the privileges of the current user. This could lead to complete compromise of the affected system, including unauthorized access, data theft, or disruption of services. Since the vulnerability allows execution of malicious programs without user interaction, it increases the risk of stealthy attacks.
Can you explain this vulnerability to me?
This vulnerability affects Adobe Framemaker versions 2022.8 and earlier and is classified as an Untrusted Search Path vulnerability. It occurs when the application uses a search path to locate critical resources such as programs. An attacker can exploit this by modifying the search path to point to a malicious program. When the application executes the program from this manipulated path, it runs the attacker's code in the context of the current user. Notably, exploiting this vulnerability does not require any user interaction.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers to execute arbitrary code in the context of the current user by exploiting an untrusted search path. Such unauthorized code execution can lead to unauthorized access, data manipulation, or data breaches.
Consequently, organizations using affected versions of Adobe Framemaker may face increased risks of non-compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized access.
However, specific impacts on compliance depend on the environment and data handled, and no direct statements about compliance effects are provided in the available information.