CVE-2026-27299 is an improper input validation vulnerability (CWE-20) in Adobe Framemaker versions 2022.8 and earlier. This flaw allows an attacker to cause the application to read arbitrary files from the file system, potentially exposing sensitive data. Exploitation requires that a victim user opens a specially crafted malicious file. The CVSS v3.1 base score is 6.3, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability impacts confidentiality but not integrity or availability. No official patch or remediation level has been published by Adobe as of the provided data.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the affected system. There is no indication of impact on system integrity or availability. The attack requires user interaction, limiting the attack surface to scenarios where a user opens a malicious file. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources. Monitor Adobe's security advisories for updates regarding patches or mitigations.