CVE-2026-27299

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27299", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-02-18T22:02:41.398Z", "datePublished": "2026-04-14T22:58:12.664Z", "dateUpdated": "2026-08-27T22:15:51.512Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Adobe Framemaker", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2022.8", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2022.9", "versionType": "custom"}]}], "datePublic": "2026-04-14T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 6.3, "environmentalSeverity": "MEDIUM", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "NONE", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "CHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "CHANGED", "temporalScore": 6.3, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "Improper Input Validation (CWE-20)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:15:51.512Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/framemaker/apsb26-36.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Adobe Framemaker | Improper Input Validation (CWE-20)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T13:28:05.897312Z", "id": "CVE-2026-27299", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T13:28:12.518Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27299", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T13:28:05.897312Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T13:28:09.308Z"}}], "cna": {"title": "Adobe Framemaker | Improper Input Validation (CWE-20)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "modifiedScope": "CHANGED", "temporalScore": 6.3, "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "MEDIUM", "availabilityImpact": "NONE", "environmentalScore": 6.3, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "MEDIUM", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "NONE", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Adobe Framemaker", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2022.8"}, {"status": "unaffected", "version": "2022.9", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-14T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/framemaker/apsb26-36.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation (CWE-20)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:15:51.512Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27299", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:15:51.512Z", "dateReserved": "2026-02-18T22:02:41.398Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-04-14T22:58:12.664Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Adobe Framemaker", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2022.8", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2022.9", "versionType": "custom"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:framemaker:*:*:*:*:*:*:*:*", "matchCriteriaId": "6943B816-3A7D-47BF-9E01-DF86C9332C19", "versionEndExcluding": "2022.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}, {"lang": "es", "value": "Las versiones 2022.8 y anteriores de Adobe Framemaker se ven afectadas por una vulnerabilidad de validaci\u00f3n de entrada incorrecta que podr\u00eda conducir a la lectura arbitraria del sistema de archivos. Un atacante podr\u00eda aprovechar esta vulnerabilidad para acceder a archivos o datos sensibles en el sistema. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, en el sentido de que la v\u00edctima debe abrir un archivo malicioso."}], "id": "CVE-2026-27299", "lastModified": "2026-08-28T00:17:13.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27299", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T13:28:05.897312Z", "version": "2.0.3"}}]}, "published": "2026-04-14T23:16:27.083", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/framemaker/apsb26-36.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2022.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Adobe Framemaker", "source": "cna", "vendor": "Adobe"}, "product": "framemaker", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-15T00:51:20.187911+00:00", "value": {"mitigation_remediation": ["Apply the latest Adobe Framemaker update that removes the improper input validation issue and eliminates the ability to read arbitrary files.", "Configure the application or operating environment to reject or block files from untrusted sources such as network shares, shared folders, or email attachments, thereby removing the user\u2011interaction vector.", "Implement application whitelisting or control to allow only trusted documents to be opened with Framemaker, preventing execution of arbitrary file paths."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized access to filesystem data"}, "threat_synthesis": {"affected_systems": "Adobe Framemaker versions 2022.8 and earlier are affected. The vulnerability does not appear in any newer releases listed in the advisory.", "description_and_impact": "Adobe Framemaker released up to version 2022.8 contains an improper input validation flaw that allows an attacker to read arbitrary files on the system. The issue is triggered when a user opens a maliciously crafted file; the application fails to validate path names and processes them as legitimate, enabling the attacker to view any file accessible to the Framemaker process.", "risk_and_exploitability": "The CVSS score of 6.3 indicates medium severity. Exploitability data are limited; the exploit probability score is not provided by the vendor. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, suggesting that it has not been widely exploited. The attack requires user interaction\u2014opening a malicious file\u2014meaning the risk is confined to environments where untrusted documents can be accessed or shared with users."}}}}, "created": "2026-04-15T14:31:57.020233+00:00", "updated": "2026-04-15T14:53:48.895430+00:00", "vendors": ["adobe", "adobe$PRODUCT$framemaker"]}