CVE-2026-95634
Adobe c2pa: server-side request forgery can lead to privilege escalation
- Risk score
- 65/100
- CVSS
- 8.6 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
- Affected
- Adobe c2pa
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Adobe c2pa: Amber, patch this week. CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
The flaws
- CVE-2026-95634: Server-side request forgery can lead to privilege escalation (CVSS 8.6 · EPSS 1%)
- CVE-2026-100138: Denial of service (CVSS 7.5 · EPSS 1%)
- CVE-2026-106627: Denial of service (CVSS 7.5 · EPSS 1%)
- CVE-2026-100113: Improper input validation (CVSS 7.5 · EPSS 1%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Adobe c2pa
Where it stands
- No known exploitation
Connects to
- Same weakness: Server-side request forgery (CWE-918). 223 other warnings in 30 days
- Same product: Earlier Adobe c2pa warnings. 28 in the last 90 days
Why it is Amber
- CVSS 8.6 high
- Remotely exploitable without logging in
References
Original description
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Last activity 13 Oct 2026. Patch Forecast updates every hour.