Log in Start free

Vulnerability · Published Aug 20, 2026 · Assigned by zdi

CVE-2026-15686Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability

High 7.2

In plain English

A high-severity security flaw in Adminer from Adminer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.2High
Exploit odds (30 days)1.1%top 34.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability. The specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12adminerno fix listedDEBIAN-CVE-2026-15686
Debian:13adminerno fix listedDEBIAN-CVE-2026-15686
Debian:14adminer5.4.3+dfsg-1DEBIAN-CVE-2026-15686
Ubuntu:22.04:LTSadminerno fix listedUBUNTU-CVE-2026-15686
Ubuntu:24.04:LTSadminerno fix listedUBUNTU-CVE-2026-15686
Ubuntu:26.04:LTSadminerno fix listedUBUNTU-CVE-2026-15686
Ubuntu:26.10adminerno fix listedUBUNTU-CVE-2026-15686

Affected products (as reported)

VendorProductVersions
Adminer Adminer 5.4.2

Weakness: CWE-253 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References