Over the past few months, the TFSec team has been digging deep into Adobe's ecosystem as part of their Public Bug Bounty Program. Our focus was on the Content Credentials SDK and Adobe Commerce (Magento).
We found 31 vulnerabilities total across three security bulletins. All patched now.
Here is how it went.
Target 1: Content Credentials SDK
Round 1, APSB26-61 and APSB26-53
Bulletins: APSB26-61 and APSB26-53
The Content Credentials SDK handles content authenticity. We spent a lot of time looking at how it parses and validates inputs.
@bau1u found 20 vulnerabilities in this SDK. Mostly:
- Uncontrolled Resource Consumption (CWE-400)
- Improper Input Validation (CWE-20)
- Integer Overflows/Underflows (CWE-190/191)
All of these let you trigger Application DoS. Some were rated Critical (CVSS 7.5).
@m411 found a different kind of bug:
- Path Traversal (CWE-22), CVE-2026-34657
This one gave you Arbitrary File System Write. Important severity (CVSS 5.5).
Round 2, APSB26-80
Bulletin: APSB26-80
After the first round got patched, I went back in and found 6 more in the same SDK. Patched in the July 2026 bulletin.
Here is what came out of it:
- Improper Input Validation (CWE-20), Critical (CVSS 7.5), CVE-2026-48351, CVE-2026-48352
- Integer Overflow or Wraparound (CWE-190), Important (CVSS 6.2), CVE-2026-48354
- Integer Underflow (CWE-191), Important (CVSS 6.2), CVE-2026-48296
- Improper Input Validation (CWE-20), Important (CVSS 6.2), CVE-2026-48302
- Improper Input Validation (CWE-20), Arbitrary File System Read (CVSS 5.5), CVE-2026-48353
Two of these were Critical. CVE-2026-48353 is the interesting one because it lets you read arbitrary files off the system, not just DoS like most of the round 1 bugs.
Target 2: Adobe Commerce (Magento)
Bulletin: APSB26-49
Adobe Commerce is a big target. @bau1u and @e0x1337 worked together on this one and found a set of critical resource consumption bugs.
Note: Adobe and NIST only credited @bau1u in the public bulletin, but this was a joint effort. Big credit to @e0x1337 for their work on this.
- Uncontrolled Resource Consumption (CWE-400), CVE-2026-34648, CVE-2026-34649, CVE-2026-34650, CVE-2026-34651
All four Critical (CVSS 7.5). Unauthenticated Application DoS.
The CVE List
@bau1u (26 CVEs):
- CVE-2026-34712, CVE-2026-34713, CVE-2026-47902, CVE-2026-47903, CVE-2026-47904, CVE-2026-47905
- CVE-2026-34665, CVE-2026-34666, CVE-2026-34667, CVE-2026-34668, CVE-2026-34669, CVE-2026-34670, CVE-2026-34671, CVE-2026-34672, CVE-2026-34673, CVE-2026-34677, CVE-2026-34678, CVE-2026-34679, CVE-2026-34680, CVE-2026-34688
- CVE-2026-48296, CVE-2026-48302, CVE-2026-48351, CVE-2026-48352, CVE-2026-48353, CVE-2026-48354
@bau1u and @e0x1337 (4 CVEs):
@m411 (1 CVE):
Conclusion
Everything has been responsibly disclosed and patched. If you use any of these products, update now.
We will post deeper technical writeups and PoCs for some of these later.