CVE-2026-15686: Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability
Adminer multiquery Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability.
The specific flaw exists within the multiquery method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate CVE (ZDI-CAN-28201) by preventing unauthenticated access to the Adminer endpoint: restrict/limit access to Adminer (and its multi_query functionality) so that only trusted users/systems can reach it (e.g., via WAF/ACL/IP allowlisting).
- Compensating control
Because exploitation requires authentication, ensure Adminer accounts are strongly secured and that any potentially compromised Adminer credentials are rotated.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to authenticate to the affected Adminer installation. Exploitation can be performed remotely and does not require user interaction.
What level of access could exploitation provide?
Successful exploitation allows arbitrary code execution in the context of the web server. The vulnerability is rated high severity with impacts to confidentiality, integrity, and availability.
Which component is involved?
The flaw is in Adminer's multi_query method, where an incorrect check of a function return value can be leveraged after authentication.