Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-100118

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could…

Risk score
56/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
Affected
Adobe c2pa
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Adobe c2paTHE FLAWSTHE FIXCVE-2026-100118CAI Content Credentials isaffected by an ImproperCertificate Validation…CVSS 7.5 · EPSS 0%CVE-2026-95634Server-side request forgerycan lead to privilege escalationCVSS 8.6 · EPSS 1%CVE-2026-100138Denial of serviceCVSS 7.5 · EPSS 1%CVE-2026-106627Denial of serviceCVSS 7.5 · EPSS 1%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedAdobe c2paAMBER · PATCH THIS WEEKAdobe c2paCAI Content Credentials isaffected by a Server-SideRequest Forgery (SSRF)vulnerability that could result inprivilege escalation. Exploitationof this issue does not requireuser interaction. Scope is…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-295 (CWE-295)82 other warnings in 30 days →Same productEarlier Adobe c2pa warnings28 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Adobe c2pa: Amber, patch this week. CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

The flaws

  • CVE-2026-100118: CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-95634: Server-side request forgery can lead to privilege escalation (CVSS 8.6 · EPSS 1%)
  • CVE-2026-100138: Denial of service (CVSS 7.5 · EPSS 1%)
  • CVE-2026-106627: Denial of service (CVSS 7.5 · EPSS 1%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Adobe c2pa

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Last activity 13 Oct 2026. Patch Forecast updates every hour.