CVE-2026-15686

Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability. The specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7#event-826206
https://www.zerodayinitiative.com/advisories/ZDI-26-478/

Configurations

No configuration.

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de ejecución remota de código por comprobación incorrecta del valor de retorno de una función en Adminer multi_query. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Adminer. Se requiere autenticación para explotar esta vulnerabilidad. La falla específica existe dentro del método multi_query. El problema resulta de una comprobación incorrecta del valor de retorno de una función. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del servidor web. Fue ZDI-CAN-28201.

Information

Published : 2026-08-20 17:17

Updated : 2026-10-26 10:10

NVD link : CVE-2026-15686

Mitre link : CVE-2026-15686

CVE.ORG link : CVE-2026-15686

JSON object : View

Products Affected

No product.

CWE

CWE-253

Incorrect Check of Function Return Value

{"id": "CVE-2026-15686", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15686", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T00:00:00+00:00"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "Adminer", "product": "Adminer", "versions": [{"status": "affected", "version": "5.4.2"}], "defaultStatus": "unknown"}]}], "published": "2026-08-20T17:17:21.180", "references": [{"url": "https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7#event-826206", "source": "zdi-disclosures@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-478/", "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-253"}]}], "descriptions": [{"lang": "en", "value": "Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo por comprobaci\u00f3n incorrecta del valor de retorno de una funci\u00f3n en Adminer multi_query. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de Adminer. Se requiere autenticaci\u00f3n para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe dentro del m\u00e9todo multi_query. El problema resulta de una comprobaci\u00f3n incorrecta del valor de retorno de una funci\u00f3n. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del servidor web. Fue ZDI-CAN-28201."}], "lastModified": "2026-10-26T10:10:00.140", "sourceIdentifier": "zdi-disclosures@trendmicro.com"}