CVE-2026-27290 is an Untrusted Search Path vulnerability affecting Adobe Framemaker versions 2022.8 and earlier. This vulnerability allows attackers to execute arbitrary code by manipulating the search path used by the application to locate critical resources, causing the application to execute a malicious program instead. The vulnerability does not require user interaction and has a CVSS 3.1 base score of 8.6, indicating high impact on confidentiality, integrity, and availability. No vendor-provided patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. Since no user interaction is required, the risk of exploitation is higher in environments where the attacker can influence the search path used by Adobe Framemaker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when running Adobe Framemaker in untrusted or potentially manipulated environments. Restricting write permissions to directories in the search path and running the application with least privilege may reduce risk. Monitor Adobe's official channels for updates and patches.