PT-2026-20965 · Unknown · Adb-Explorer

Agentmisterious · Published 2026-02-19 · Updated 2026-02-25 · CVE-2026-26959

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADB Explorer versions 0.9.26020 and below

Description ADB Explorer versions 0.9.26020 and below do not properly validate the integrity or authenticity of the ADB binary path specified in the ManualAdbPath setting before execution. This can lead to arbitrary code execution with the privileges of the current user. An attacker can exploit this by creating a malicious App.txt settings file that points ManualAdbPath to an arbitrary executable and then convincing a user to launch the application with a command-line argument directing it to the malicious configuration directory. This could be achieved through social engineering, such as distributing a shortcut bundled with a crafted settings file in an archive, resulting in remote code execution upon application startup.

Recommendations Versions prior to 0.9.26021 should be updated.

Exploit

Fix

RCE

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-26959

GHSA-GCGV-2JQ7-74RP

Affected Products

Adb-Explorer

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26959.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-26959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26959 · Security Note
• https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-gcgv-2jq7-74rp · Note
• https://github.com/Alex4SSB/ADB-Explorer/commit/1b9fed20e875f5e74fd04e9889402f969c2d34e4 · Note
• https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26021 · Note
• https://t.me/CVEtracker/45211 · Telegram Post
• https://twitter.com/cracbot/status/2026613191854436369 · Twitter Post
• https://t.me/cveNotify/152544 · Telegram Post