CVE-2026-27290
Last modified
CVE-2026-27290 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Framemaker | < 2022.9 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27290?
How severe is CVE-2026-27290?
How do I fix CVE-2026-27290?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27285InDesign Desktop versions 20.5.2, 21.2 and earlier are affec…5.5
- CVE-2026-27286InDesign Desktop versions 20.5.2, 21.2 and earlier are affec…5.5
- CVE-2026-27287InCopy versions 20.5.2, 21.2 and earlier are affected by an …7.8
- CVE-2026-27288Adobe Experience Manager versions 6.5.24, FP11.7 and earlier…5.4
- CVE-2026-27289Photoshop Desktop versions 27.4 and earlier are affected by …7.8
- CVE-2026-2729The Forminator plugin for WordPress is vulnerable to authori…5.3
- CVE-2026-27291InDesign Desktop versions 20.5.2, 21.2 and earlier are affec…7.8
- CVE-2026-27292Adobe Framemaker versions 2022.8 and earlier are affected by…7.8
- CVE-2026-27293Adobe Framemaker versions 2022.8 and earlier are affected by…7.8
- CVE-2026-27294Adobe Framemaker versions 2022.8 and earlier are affected by…7.8
- CVE-2026-27295Adobe Framemaker versions 2022.8 and earlier are affected by…7.8
- CVE-2026-27296Adobe Framemaker versions 2022.8 and earlier are affected by…7.8
Are you affected by CVE-2026-27290?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST