CVE-2026-100115: Improper Access Control (CWE-284) in Adobe Content Credentials Rust SDK

The Adobe Content Credentials Rust SDK contains an Improper Access Control (CWE-284) vulnerability that enables attackers to bypass security controls and obtain unauthorized write permissions. This flaw can be exploited remotely without requiring any user interaction, increasing its risk. The vulnerability is identified as CVE-2026-100115 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no information about available patches or vendor advisories, and no known exploits in the wild have been reported.

An attacker exploiting this vulnerability can bypass security mechanisms to gain unauthorized write access within the Adobe Content Credentials Rust SDK environment. This compromises the integrity of the system or data managed by the SDK but does not affect confidentiality or availability. The vulnerability can be exploited remotely without any user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected SDK and monitor for unusual write activities related to Content Credentials. Follow Adobe's official communications for updates on patches or mitigations.