Adobe Content Credentials CVE-2026-100119

Exploitation requires that a target application or service embed and invoke the Adobe CAI Content Credentials SDK to process or validate content credentials (C2PA provenance manifests) on attacker-supplied input, and that this input path be reachable by the attacker (network-reachable per AV:N). No authentication is required (PR:N) and no user interaction is needed (UI:N), so against a reachable, default SDK validation path exploitation is unauthenticated and automated. The principal limiting factors are deployment-specific: the vulnerable SDK version must be in use, the application must expose the content-credential parsing/validation path to untrusted input, and exact affected versions must be confirmed from Adobe APSB26-163; impact is confined to integrity/unauthorized write (no confidentiality or availability loss).

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which would normally rank as a high-priority issue; however, the scored impact is narrow - integrity only (C:N/I:H/A:N), consistent with a security-feature bypass that grants unauthorized write access rather than full code execution or data theft. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so the exploitation-likelihood dimension cannot be quantified from this input. The absence of KEV and POC signals, combined with Adobe PSIRT as the sole reporter (vendor-discovered, not exploitation-driven), suggests this is currently a theoretical/responsibly-disclosed issue rather than an actively exploited one. Note a tag/description mismatch: the input Tags label this 'Authentication Bypass,' but the description and CWE-20 (Improper Input Validation) describe a SECURITY FEATURE bypass yielding unauthorized write access - not an authentication bypass - so treat the raw 'high-CVSS unauthenticated' framing cautiously and verify the exact affected feature against Adobe advisory APSB26-163. Net: a genuine integrity-bypass flaw worth patching in affected deployments, but the limited product footprint and lack of exploitation signals keep it below the tier of ubiquitous-software critical bugs.

An attacker submits specially crafted input to an application or service that uses the CAI Content Credentials SDK to parse or validate content credentials (C2PA provenance manifests). Because input validation is improper, the malformed input bypasses the intended security check and allows the attacker to perform an unauthorized write - for example, tampering with or injecting content-credential data that should have been rejected. No user interaction is required (UI:N), and per the CVSS vector no authentication is needed; no public exploit code was identified at time of analysis.