What is the CVSS score of CVE-2026-27290?

CVE-2026-27290 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Framemaker are affected by CVE-2026-27290?

Adobe FrameMaker versions 2022.8 and earlier contain a critical local privilege escalation vulnerability (CVE-2026-27290) that allows attackers to execute arbitrary code with user-level privileges…

How to fix or mitigate CVE-2026-27290?

Within 24 hours: Inventory all systems running Adobe FrameMaker 2022.8 or earlier and isolate high-risk endpoints if patching cannot be completed immediately. Within 7 days: Apply vendor-released patch per Adobe Security Bulletin APSB26-36 to all affected FrameMaker installations; verify patch deployment across the organization. Within 30 days: Conduct post-patch validation testing and review access logs for any suspicious local process execution tied to FrameMaker.

Framemaker CVE-2026-27290

EUVD-2026-22778 HIGH

Untrusted Search Path (CWE-426)

2026-04-14 psirt@adobe.com

RCE Adobe Framemaker

8.6

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 01:10 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 23:22 euvd

EUVD-2026-22778

Analysis Generated

Apr 14, 2026 - 23:22 vuln.today

CVE Published

Apr 14, 2026 - 23:16 nvd

HIGH 8.6

DescriptionCVE.org

Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction.

AnalysisAI

Arbitrary code execution in Adobe FrameMaker 2022.8 and earlier via DLL hijacking/search path manipulation allows local attackers to run malicious code in user context without interaction. CVSS 8.6 severity stems from changed scope and high confidentiality/integrity/availability impact despite local attack vector. No public exploit identified at time of analysis. EPSS data not available for this recent CVE. Vendor patch released per Adobe Security Bulletin APSB26-36.

Technical ContextAI

This is an Untrusted Search Path vulnerability (CWE-426) in Adobe FrameMaker, a document processing application for technical documentation and publishing. The flaw allows attackers to manipulate the application's DLL search order or executable path resolution mechanism. When FrameMaker attempts to load critical resources (libraries, plugins, or executables), it searches directories in a predictable sequence. An attacker with local file system access can plant a malicious DLL or executable in a directory that precedes legitimate locations in the search path, causing FrameMaker to load and execute the attacker-controlled code instead of the intended resource. The vulnerability affects all Adobe FrameMaker versions through 2022.8, indicating a design-level flaw in how the application resolves resource locations rather than a recent regression.

RemediationAI

Apply Adobe's security update by upgrading to the patched version specified in Security Bulletin APSB26-36 (https://helpx.adobe.com/security/products/framemaker/apsb26-36.html). The bulletin, released by Adobe's Product Security Incident Response Team (psirt@adobe.com), contains exact version numbers for the fix and installation instructions. As an interim mitigation before patching, restrict write permissions on FrameMaker installation directories and application data folders to prevent unauthorized file placement. Implement application whitelisting or endpoint detection controls to block execution of unsigned DLLs from user-writable directories. For enterprise deployments, use centralized patch management to ensure consistent updates across all FrameMaker installations. Verify the integrity of FrameMaker directory structures after patching to ensure no malicious files persist from prior exploitation attempts.