ADB Explorer is a fluent UI for ADB on Windows. In versions prior to Beta 0.9.26022, ADB-Explorer allows the `ManualAdbPath` settings variable, which determines the path of the ADB binary to be executed, to be set to a Universal Naming Convention (UNC) path in the application's settings file. This allows an attacker to set the binary's path to point to a remote network resource, hosted on an attacker-controlled network share, thus granting the attacker full control over the binary being executed by the app. An attacker may leverage this vulnerability to execute code remotely on a victim's machine with the privileges of the user running the app. Exploitation is made possible by convincing a victim to run a shortcut of the app that points to a custom `App.txt` settings file, which sets `ManualAdbPath` (for example, when downloaded in an archive file). Version Beta 0.9.26022 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-3f27-jp2g-hwhr | Exploit Vendor Advisory |
| https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-3f27-jp2g-hwhr | Exploit Vendor Advisory |
Configurations
History
27 Feb 2026, 19:04
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-3f27-jp2g-hwhr - Exploit, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:a:alex4ssb:adb_explorer:*:*:*:*:*:windows:*:* | |
| First Time |
Alex4ssb adb Explorer
Alex4ssb |
27 Feb 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Alex4SSB/ADB-Explorer/security/advisories/GHSA-3f27-jp2g-hwhr - |
25 Feb 2026, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-25 03:16
Updated : 2026-02-27 19:04
NVD link : CVE-2026-27615
Mitre link : CVE-2026-27615
CVE.ORG link : CVE-2026-27615
JSON object : View
Products Affected
alex4ssb
- adb_explorer