CVE-2026-12787: Zhilink ADP Platform RCE Vulnerability

CVE-2026-12787 Overview

CVE-2026-12787 is an insecure deserialization vulnerability in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 version 1.0.0. The flaw resides in the testConnection endpoint, where manipulation of the jdbcUrl argument triggers unsafe deserialization. An authenticated remote attacker with low privileges can exploit the issue across the network. The exploit details have been disclosed publicly, increasing the likelihood of opportunistic abuse. The vendor was contacted prior to disclosure but did not respond. The weakness is classified under [CWE-20: Improper Input Validation].

Critical Impact
Remote attackers with low-privilege access can submit crafted jdbcUrl values to the testConnection endpoint and trigger deserialization, potentially affecting confidentiality, integrity, and availability of the ADP platform.

Affected Products

zhilink ADP Application Developer Platform 应用开发者平台 1.0.0
testConnection endpoint component
Deployments exposing the ADP web interface to untrusted networks

Discovery Timeline

2026-06-21 - CVE-2026-12787 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12787

Vulnerability Analysis

The vulnerability affects the testConnection endpoint of the ADP Application Developer Platform. This endpoint accepts a user-supplied jdbcUrl parameter intended to validate database connectivity. The platform processes the supplied value without sufficient validation, leading to deserialization of attacker-controlled data. Deserialization flaws in JDBC connection handling commonly allow adversaries to point the URL at malicious back-end services or embed crafted properties that instantiate dangerous Java classes during driver negotiation. Because the request can be issued remotely by an authenticated user with low privileges, the attack surface includes any tenant or developer with platform access. Public disclosure of exploitation details lowers the barrier for opportunistic abuse against exposed instances.

Root Cause

The root cause is improper input validation [CWE-20] on the jdbcUrl argument. The endpoint does not constrain the JDBC URL scheme, host, or embedded properties before passing the value to a connection routine that performs deserialization. As a result, untrusted data is interpreted as serialized object input or used to load remote class data during driver initialization.

Attack Vector

Exploitation is performed over the network against the ADP web interface. The attacker authenticates with low-privilege credentials and submits a POST request to the testConnection endpoint containing a crafted jdbcUrl. The malicious URL references attacker-controlled infrastructure or includes parameters that cause the server to deserialize hostile content during the connection attempt. No user interaction is required.

No verified proof-of-concept code has been published for citation. See the VulDB entry for CVE-2026-12787 and the Feishu disclosure document for additional technical context.

Detection Methods for CVE-2026-12787

Indicators of Compromise

HTTP requests to the testConnection endpoint containing unusual or externally hosted jdbcUrl values
Outbound connections from the ADP server to unexpected hosts immediately following a testConnection request
Java process spawning unexpected child processes or loading unfamiliar classes during JDBC initialization
Authentication events from low-privilege accounts followed by testConnection calls referencing non-standard JDBC schemes

Detection Strategies

Inspect web server and application logs for testConnection requests where jdbcUrl references untrusted hosts or includes serialized payload markers
Apply web application firewall rules to flag JDBC URLs containing suspicious properties such as autoDeserialize=true or remote codebase parameters
Correlate authentication events with rapid invocation of testConnection to detect credential-driven probing

Monitoring Recommendations

Capture full request bodies for the testConnection endpoint and retain them for forensic review
Monitor egress traffic from ADP servers and alert on connections to non-approved database hosts
Track JVM behavior on the ADP host for unexpected class loading or process execution

How to Mitigate CVE-2026-12787

Immediate Actions Required

Restrict network access to the ADP testConnection endpoint so that only trusted administrative networks can reach it
Audit and reduce the number of accounts that hold the low-privilege role required to invoke testConnection
Review historical logs for prior abuse of the testConnection endpoint and rotate any credentials that may have been exposed

Patch Information

No vendor patch is available. The vendor did not respond to disclosure attempts according to the published advisory. Track the VulDB entry for CVE-2026-12787 for updates and apply vendor fixes once released.

Workarounds

Block the testConnection endpoint at a reverse proxy or web application firewall until a vendor patch is published
Constrain accepted jdbcUrl values using an allowlist of approved JDBC schemes and hosts at the network edge
Disable or remove the ADP Application Developer Platform 1.0.0 instance from internet-facing networks if it is not required

bash

# Example reverse proxy rule to block external access to the testConnection endpoint
location ~* /testConnection {
    allow 10.0.0.0/8;       # internal admin network only
    deny all;
    return 403;
}