Is CVE-2026-27299 actively exploited?

No active exploitation of CVE-2026-27299 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27299 be exploited remotely?

No. CVE-2026-27299 requires local access to exploit.

What is the CVSS score of CVE-2026-27299?

CVE-2026-27299 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-27299

MEDIUM

CVE-2026-27299

CWE-20Published: April 14, 2026· Updated: Apr 15, 2026

6.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.8th

Official Description

Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

NVD Source

Technical Analysis

CVE-2026-27299 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.3.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.