Adminer CVE-2026-15686

Authentication with high-privilege credentials is required to exploit this vulnerability, confirmed both by the CVE description ('Authentication is required to exploit this vulnerability') and the CVSS PR:H metric. The specific trigger is use of the multi_query method within Adminer, which is available to any authenticated user with sufficient database privileges - no non-default feature flag or special configuration is required to enable this code path. Any standard installation of Adminer 5.4.2 that is network-reachable and where an attacker holds valid high-privilege database credentials is vulnerable. The primary factors limiting exploitation are: (1) the requirement to possess or obtain valid high-privilege credentials before any exploit attempt can begin, and (2) the need for network reachability to the Adminer login endpoint. Scope remains unchanged (S:U), so exploitation is bounded to the web server process context and does not inherently escalate to adjacent systems without additional post-exploitation steps.

The CVSS 3.0 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H places real-world risk in a well-defined envelope: network-reachable but gated entirely behind high-privilege authentication, with no attack complexity once credentials are held. The PR:H rating is the dominant risk-reduction signal - only users already in possession of valid administrative credentials for both Adminer and the connected database can exploit this flaw. EPSS data was not present in the provided intelligence, and the CVE is not listed in the CISA KEV, indicating no confirmed widespread active exploitation at time of analysis; even a mid-sized municipal IT team in boleslawiec running Adminer internally behind a VPN faces a materially lower threat posture than an organization exposing the interface to the public internet. The absence of a public POC further moderates near-term risk, though the ZDI advisory publication may lower the bar for exploit development by researchers and threat actors. The full C/I/A impact at S:U confirms that exploitation, once authentication is cleared, fully compromises the web server process but does not inherently break out to adjacent systems. Priority should be elevated for any deployment where Adminer is internet-facing or where database credentials are shared across multiple personnel.

An attacker who obtains valid high-privilege Adminer credentials - through phishing, credential reuse from another breach, or compromising a shared admin account - logs into the publicly accessible Adminer interface and submits a crafted multi-statement SQL payload targeting the multi_query method. Due to the missing or incorrect return value check, the error-handling path is bypassed, and the attacker achieves arbitrary code execution running as the web server user (e.g., www-data). No public proof-of-concept has been identified at time of analysis, but the low attack complexity once authenticated means exploitation would not require specialized database or web exploitation expertise.