CVE-2026-15686 Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability
Remote attackers with authentication can execute arbitrary code on Adminer installations due to an incorrect return value check in the multi_query method.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15686?
CVE-2026-15686 is a high-severity code injection vulnerability in Adminer, published on 20 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability.
The specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201.
Weakness: CWE-253
Which versions are affected by CVE-2026-15686?
How do I fix CVE-2026-15686?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-15686 being exploited?
There is no known exploitation of CVE-2026-15686 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-15686, GHSA-3582-q6xq-5vf7, GHSA-cmr6-cvgm-wxx6, UBUNTU-CVE-2026-15686.