Is CVE-2026-123261 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123261 being exploited in the wild.

How severe is CVE-2026-123261?

Medium severity, with a CVSS score of 5.9, published 10 November 2026.

Which products and versions are affected?

Adobe C2PA Tool (c2patool) c2patool-v0.28.5 and earlier; Adobe Content Credentials Rust SDK (c2pa) c2pa-v0.91.10 and earlier.

Is there a fix for CVE-2026-123261?

Yes: fixed in Content Credentials Rust SDK c2pa-v0.91.11, C2PA Tool c2patool-v0.28.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123261 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123261?

Check whether you run Adobe C2PA Tool (c2patool) or Adobe Content Credentials Rust SDK (c2pa) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123261: Adobe Content Credentials SDK improper cryptographic signature verification

CVE-2026-123261 · Severity: medium · CVSS 5.9 · Published 2026-11-10

Adobe Content Credentials SDK, which manages and verifies digital signatures on media files to prove authenticity and provenance, contains a flaw in how it verifies cryptographic signatures. An attacker could bypass the signature verification controls to forge or tamper with credential metadata without detection. This could allow unauthorized modification of content attribution records or enable distribution of fraudulent authenticated media.

Technologies: Adobe C2PA Tool (c2patool), Adobe Content Credentials Rust SDK (c2pa). Vendors: Adobe.

Quick answers

Is CVE-2026-123261 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123261 being exploited in the wild.
How severe is CVE-2026-123261?: Medium severity, with a CVSS score of 5.9, published 10 November 2026.
Which products and versions are affected?: Adobe C2PA Tool (c2patool) c2patool-v0.28.5 and earlier; Adobe Content Credentials Rust SDK (c2pa) c2pa-v0.91.10 and earlier.
Is there a fix for CVE-2026-123261?: Yes: fixed in Content Credentials Rust SDK c2pa-v0.91.11, C2PA Tool c2patool-v0.28.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123261 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123261?: Check whether you run Adobe C2PA Tool (c2patool) or Adobe Content Credentials Rust SDK (c2pa) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Content Credentials Rust SDK c2pa-v0.91.11, C2PA Tool c2patool-v0.28.6

Technical details

CVE-2026-123261 is an improper verification of cryptographic signature (CWE-347) flaw in the Content Credentials Rust SDK (c2pa) and C2PA Tool. The vulnerability allows an attacker to bypass signature verification controls via network-based attack with high complexity preconditions and no user interaction required. Successful exploitation grants the ability to write or modify data without authorization; fixes are available in c2pa v0.91.11 and c2patool v0.28.6.

Affected products

Adobe Content Credentials Rust SDK (c2pa) c2pa-v0.91.10 and earlier
Adobe C2PA Tool (c2patool) c2patool-v0.28.5 and earlier

Timeline

2026-11-10: disclosed

References

https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.