Adobe FrameMaker Hit by Untrusted Search Path Flaw

The National Vulnerability Database (NVD) recently highlighted a significant vulnerability, CVE-2026-27290, impacting Adobe FrameMaker versions 2022.8 and earlier. This isn’t your run-of-the-mill bug; it’s an Untrusted Search Path flaw, a classic attack vector that can be a real headache. Essentially, if an application relies on a predefined search path to locate critical executables or resources, an attacker can manipulate that path.

By tweaking the search path to point to a malicious program, the targeted application ends up executing the attacker’s code instead of the legitimate one. What makes this particularly nasty is that, according to the NVD, exploiting this issue doesn’t require any user interaction – a true ‘zero-click’ scenario. With a CVSS score of 8.6 (HIGH), this isn’t something to shrug off. The CWE-426 classification underscores the severity of such path manipulation vulnerabilities, which often lead to arbitrary code execution and system compromise.