CAI Content Credentials CVE-2026-100122

The CVE description does not name a specific configuration flag, protocol mode, or feature toggle; it states only that exploitation does not require user interaction and (per PR:N) no authentication. The concrete prerequisite inferred from CWE-295 is that the attacker must be able to present content bearing an improperly validated certificate to a component using the CAI Content Credentials SDK - in practice this usually means either supplying crafted signed content or holding a man-in-the-middle position on the validation path. Limiting factors: exploitation is bounded to integrity (unauthorized write / content tampering) with no confidentiality or availability impact, and only affects deployments that actually use the Content Credentials SDK to validate certificates; the exact affected versions and whether a non-default mode is required are not stated in the input and should be confirmed against Adobe APSB26-163.

Signals are mixed and skew toward a moderate, not urgent, priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated issue with high integrity impact but no confidentiality or availability impact - consistent with a security-feature/certificate-validation bypass granting unauthorized write access. However, no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent exploitation. A notable tension exists between the CWE-295 (Improper Certificate Validation) root cause and the AC:L rating: certificate-validation bypasses frequently require a man-in-the-middle position or the ability to present a crafted/forged certificate, which can raise real-world attack complexity above what AC:L implies - verify the exploitation path with Adobe's advisory (APSB26-163). Net assessment: a legitimately high-CVSS integrity flaw worth patching on a normal cadence, but absent KEV/POC/EPSS signals it is not a drop-everything emergency.

An attacker positioned to interpose or supply content to a system using the CAI Content Credentials SDK presents data accompanied by an improperly validated certificate; because the SDK fails to properly verify the certificate, the attacker bypasses the content-authenticity security control and injects or alters signed content, gaining unauthorized write access without any user interaction. No public exploit code is identified at the time of analysis, so this scenario is inferred from the CVSS vector and CWE-295 root cause rather than a demonstrated exploit.