Back in July we posted about finding 31 CVEs in Adobe Content Credentials SDK and Adobe Commerce. At the end of that post we said we would keep going.
We kept going. 16 more CVEs across four new Adobe security bulletins since then. All patched.
Here is what happened.
I Kept Breaking the Content Credentials SDK
The Content Credentials SDK is the thing Adobe built for content authenticity. C2PA manifests, JUMBF boxes, media validation. I have been auditing it since early 2026 and every time they patch a round of bugs I go back in and find more in the new code.
After the first two rounds (covered in the previous post), I found 15 more across three separate bulletins. Same SDK, same attack surface, new bugs every time.
Round 3 (August 11, 2026)
Bulletin: APSB26-111
Eight more. This round had something new though. First ever NULL Pointer Dereference in this SDK:
- NULL Pointer Dereference (CWE-476), CVSS 7.5, CVE-2026-48438
Send crafted input, crash the whole thing. Different from the resource consumption bugs because it is an instant crash, not a slow death.
The rest were more of the usual:
- Uncontrolled Resource Consumption (CWE-400), CVSS 7.5, CVE-2026-48439
- Integer Overflow (CWE-190), CVSS 6.2, CVE-2026-48387, CVE-2026-48445
- Integer Underflow (CWE-191), CVSS 6.2, CVE-2026-48435, CVE-2026-71389
- Uncontrolled Resource Consumption (CWE-400), CVSS 6.2, CVE-2026-48434, CVE-2026-48443
Round 4 (August 25, 2026)
Bulletin: APSB26-110
Two weeks later Adobe pushed the APSB26-111 fix. I tested the patched version. Found five more.
Three rated High:
- Uncontrolled Resource Consumption (CWE-400), CVSS 7.5, CVE-2026-71360
- Improper Input Validation (CWE-20), CVSS 7.5, CVE-2026-71443
- Integer Underflow (CWE-191), CVSS 7.5, CVE-2026-71442
Two rated Medium:
- Integer Underflow (CWE-191), CVSS 6.2, CVE-2026-71444, CVE-2026-76189
Round 5 (September 22, 2026)
Bulletin: APSB26-147
Most recent round. Two more.
- Improper Input Validation (CWE-20), CVSS 5.5, CVE-2026-75633
- Integer Overflow (CWE-190), CVSS 5.5, CVE-2026-89277
That makes it 41 Content Credentials SDK CVEs from bau1u across five security bulletins (APSB26-53, APSB26-61, APSB26-80, APSB26-111, APSB26-110, APSB26-147). The bug surface is the same every time. How the SDK parses C2PA manifests, validates JUMBF boxes, handles integer boundaries in media inputs. Adobe patches one set of parsing bugs and the next version has new ones in the updated code paths.
e0x1337 Solo Adobe Commerce Privilege Escalation
Bulletin: APSB26-138
This one is a big deal for the team.
In the first Adobe post, the four Adobe Commerce CVEs were a joint effort between bau1u and e0x1337. Adobe only credited bau1u in the public bulletin for those, which we noted was not the full picture.
This time e0x1337 found one completely on his own. And it is not a DoS bug. It is a privilege escalation in Adobe Commerce:
- Incorrect Authorization (CWE-863), CVSS 8.2, CVE-2026-76202
An unauthenticated attacker can exploit this to gain elevated access to sensitive information. No user interaction required. Adobe rated it Critical in their bulletin.
CVSS 8.2 makes this the highest scoring CVE any TFSec member has reported. It is also the first authorization bypass in our collection. Everything else has been DoS, file read/write, or SSRF. This is a different class of bug entirely and e0x1337 found it solo on one of the biggest e-commerce platforms in the world.
For context, Adobe Commerce (Magento) powers hundreds of thousands of online stores globally. A privilege escalation bug here is serious.
The Numbers So Far
Since we started targeting Adobe through HackerOne in early 2026:
| Researcher | Product | CVEs | Bulletins |
|---|---|---|---|
| bau1u | Content Credentials SDK | 41 | APSB26-53, APSB26-61, APSB26-80, APSB26-111, APSB26-110, APSB26-147 |
| bau1u + e0x1337 | Adobe Commerce | 4 | APSB26-49 |
| e0x1337 | Adobe Commerce | 1 | APSB26-138 |
| m411 | Content Credentials SDK | 1 | APSB26-61 |
| Total | 47 | 8 bulletins |
47 Adobe CVEs total. bau1u is currently ranked #1 on Adobe's HackerOne leaderboard for 2026 and #6 all time.
All 16 New CVE IDs
bau1u (15 CVEs across Content Credentials SDK):
- CVE-2026-48439, CVE-2026-48438, CVE-2026-48387, CVE-2026-48435, CVE-2026-48445, CVE-2026-48434, CVE-2026-48443, CVE-2026-71389
- CVE-2026-71360, CVE-2026-71443, CVE-2026-71442, CVE-2026-71444, CVE-2026-76189
- CVE-2026-75633, CVE-2026-89277
e0x1337 (1 CVE in Adobe Commerce):
Conclusion
Everything has been responsibly disclosed and patched through Adobe's HackerOne program. If you use Adobe Content Credentials SDK or Adobe Commerce, update to the latest versions.
We are still going. The Content Credentials SDK keeps getting updates and every new version is worth looking at. And e0x1337 is hunting more Commerce bugs.
For the full list of all 48 CVEs and advisories from the TFSec team, check our CVEs page.