PT-2026-8026 · Unknown · Adb-Explorer+1

Blankshiro · Published 2026-02-13 · Updated 2026-02-18 · CVE-2026-26208

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ADB Explorer versions prior to Beta 0.9.26020

Description ADB Explorer, a fluent UI for ADB on Windows, contains a flaw due to Insecure Deserialization, potentially leading to Remote Code Execution. The application deserializes the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. An attacker can provide a specially crafted JSON file containing a gadget chain, such as ObjectDataProvider, to execute arbitrary code when the application launches and saves its settings.

Recommendations Update to Beta 0.9.26020 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-26208

GHSA-49QX-WPXJ-P4MH

Affected Products

Adb-Explorer

Newtonsoft.Json

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26208.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26208 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26208 · Vendor Advisory
• https://github.com/Alex4SSB/ADB-Explorer/commit/776f132cede86e1405520f2a28c78276dda5ab5a · Note
• https://github.com/Alex4SSB/ADB-Explorer/issues/294 · Note
• https://github.com/Alex4SSB/ADB-Explorer/releases/tag/v0.9.26020 · Note
• https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-49qx-wpxj-p4mh · Note
• https://twitter.com/CVEnew/status/2022387975011864706 · Twitter Post
• https://t.me/CVEtracker/44645 · Telegram Post
• https://twitter.com/cracbot/status/2024076496156197105 · Twitter Post