CVE-2026-100113
Adobe c2pa: improper input validation
- Risk score
- 59/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Affected
- Adobe c2pa
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Adobe c2pa: Amber, patch this week. CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
The flaws
- CVE-2026-100113: Improper input validation (CVSS 7.5 · EPSS 1%)
- CVE-2026-95634: Server-side request forgery can lead to privilege escalation (CVSS 8.6 · EPSS 0%)
- CVE-2026-100138: Denial of service (CVSS 7.5 · EPSS 1%)
- CVE-2026-106627: Denial of service (CVSS 7.5 · EPSS 1%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Adobe c2pa
Where it stands
- No known exploitation
Connects to
- Same weakness: Server-side request forgery (CWE-918). 221 other warnings in 30 days
- Same product: Earlier Adobe c2pa warnings. 28 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
Last activity 13 Oct 2026. Patch Forecast updates every hour.