CVE-2026-106627
7.5HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Remote, unauthenticated attackers can crash your service via denial-of-service without user interaction. They only need network access to send requests to the application processing Content Credentials.
Root cause
The application fails to properly limit resource allocation during processing, allowing uncontrolled resource consumption.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade CAI Content Credentials to the fixed release specified in Adobe advisory APSB26-163; if patching immediately is impossible, restrict untrusted network access to the processing endpoint or rate-limit inbound requests.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.