CVE-2026-27290 is an Untrusted Search Path vulnerability affecting Adobe Framemaker 2022.8 and earlier. The vulnerability arises when the application uses a search path to locate critical resources such as executables or libraries. An attacker who can modify the search path could cause the application to execute malicious code in the context of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) indicates local attack vector with low complexity, no privileges required, but user interaction is needed, and the vulnerability affects confidentiality, integrity, and availability with high impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. Because the vulnerability involves an untrusted search path, attackers could redirect execution to malicious programs without requiring elevated privileges. The high CVSS score reflects the serious impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when running Adobe Framemaker and avoid running the application in untrusted environments or with untrusted files. Monitoring for updates from Adobe is recommended to apply any forthcoming patches promptly.