Adobe Content Credentials CVE-2026-100135

Exploitation requires the target application to embed and expose the Adobe CAI Content Credentials SDK's input-processing path to attacker-supplied data; the flaw is triggered by malformed input that defeats input validation and a security control to gain unauthorized write access. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed, so any network-reachable deployment that feeds untrusted input into the vulnerable SDK functions is exposed. LIMITING factors: the attack surface exists only where this specific SDK is integrated and its input path is reachable by attackers; impact is confined to integrity (unauthorized write) with no confidentiality or availability effect, and exact affected versions must be confirmed against Adobe advisory APSB26-163.

This is a CVSS 7.5 (High) integrity-only vulnerability (C:N/I:H/A:N) in the Adobe CAI Content Credentials SDK, reported directly by Adobe PSIRT. The CVSS vector signals favorable conditions for an attacker: AV:N (network reachable), AC:L (low complexity), PR:N (no authentication), and UI:N (no user interaction) - meaning a remote, unauthenticated attacker can trigger it against a reachable instance. However, several key real-world risk signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no indication of public exploit code. Exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of KEV/EPSS data means I cannot confirm active or probable exploitation - the elevated CVSS is driven by the easy access vector, not by evidence of real-world attacks. Note a labeling nuance: the single Tag is 'Authentication Bypass,' while the description and CWE-20 frame this as an improper-input-validation security-feature bypass yielding unauthorized write access; these are related but not identical, so treat the 'authentication bypass' framing cautiously. Net: prioritize as a patchable high-integrity SDK flaw, but given the SDK's specialized footprint and no exploitation evidence, this is below the urgency of a KEV-listed or mass-exploited bug.

A remote, unauthenticated attacker sends crafted/malformed input to an application embedding the Adobe CAI Content Credentials SDK, where improper input validation allows the attacker to bypass a security control and obtain unauthorized write access - potentially tampering with content-provenance data or credentials without user interaction. No public proof-of-concept exploit is identified in the provided data. The network vector and low attack complexity (AV:N/AC:L) make the trigger straightforward wherever the SDK processes attacker-supplied input.