PT-2026-8026 · Unknown · Adb-Explorer+1

Blankshiro · Publicado 2026-02-13 · Atualizado 2026-02-18 · CVE-2026-26208

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADB Explorer versions prior to Beta 0.9.26020

Description ADB Explorer, a fluent UI for ADB on Windows, contains a flaw due to Insecure Deserialization, potentially leading to Remote Code Execution. The application deserializes the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. An attacker can provide a specially crafted JSON file containing a gadget chain, such as ObjectDataProvider, to execute arbitrary code when the application launches and saves its settings.

Recommendations Update to Beta 0.9.26020 or later.

Exploit

Correção

RCE

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2026-26208

GHSA-49QX-WPXJ-P4MH

Produtos afetados

Adb-Explorer

Newtonsoft.Json

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26208.json · Exploit
• https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a · Nota
• https://github.com/Alex4SSB/ADB-Explorer/issues/294 · Nota
• https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020 · Nota
• https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh · Nota
• https://twitter.com/CVEnew/status/2022387975011864706 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26208 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-26208 · Aviso do Fabricante
• https://t.me/CVEtracker/44645 · Publicação no Telegram
• https://twitter.com/cracbot/status/2024076496156197105 · Publicação no Twitter