Adobe Framemaker up to 2022.8 untrusted search path

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Adobe Framemaker up to 2022.8. The impacted element is an unknown function. The manipulation leads to untrusted search path. This vulnerability is uniquely identified as CVE-2026-27290. Local access is required to approach this attack. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Adobe Framemaker up to 2022.8. This issue affects an unknown functionality. The manipulation with an unknown input leads to a untrusted search path vulnerability. Using CWE to declare the problem leads to CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction.

The advisory is shared at helpx.adobe.com. The identification of this vulnerability is CVE-2026-27290 since 02/18/2026. The exploitation is known to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/15/2026). MITRE ATT&CK project uses the attack technique T1574 for this issue.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Adobe

Name

• Framemaker

Version

• 2022.0
• 2022.1
• 2022.2
• 2022.3
• 2022.4
• 2022.5
• 2022.6
• 2022.7
• 2022.8

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion