Adminer Database Management Tool Vulnerable to Remote Code Execution
A critical vulnerability in the Adminer web-based database management tool allows authenticated attackers to execute arbitrary code on affected systems.
A remote code execution vulnerability has been discovered in Adminer, a popular web-based database management tool. The flaw, identified as ZDI-26-478 and assigned CVE-2026-15686, resides within the tool's multi_query functionality.
Exploitation of this vulnerability requires an attacker to first gain authentication to a vulnerable Adminer installation. Once authenticated, the attacker can leverage a flaw related to an incorrect check of a function's return value. This oversight allows for the injection and execution of arbitrary code in the context of the web server process.
The Zero Day Initiative (ZDI), which disclosed the vulnerability, has assigned it a CVSS score of 7.2, indicating a high severity. This score reflects the potential for significant impact on affected systems, including data compromise, unauthorized access, and further network infiltration.
Adminer has released an update to address this security concern. Users are strongly advised to update their Adminer installations to the latest version to mitigate the risk of exploitation. The vendor's security advisory provides further details on the fix and recommended actions.
The vulnerability was initially reported to the vendor on March 6, 2026, by researchers from 0daystolive (Sorcery Ltd). A coordinated public release of the advisory occurred on July 29, 2026, with an update to the advisory also published on the same day.
This vulnerability highlights the ongoing risks associated with web-facing applications, particularly those that handle sensitive data like database management tools. Even with authentication requirements, flaws can still lead to severe consequences if not promptly patched.
System administrators should ensure that all instances of Adminer are kept up-to-date and that access to the tool is restricted to trusted users and networks. Regular security audits and vulnerability scanning can help identify and address potential risks before they can be exploited by malicious actors.
While Adminer is a lightweight and widely used tool, its security is paramount. This recent disclosure serves as a reminder for developers and users alike to prioritize security best practices and timely patching to protect against the ever-evolving threat landscape.