CVE-2026-26959: ADB Explorer RCE Vulnerability

CVE-2026-26959 Overview

ADB Explorer, a fluent UI application for Android Debug Bridge (ADB) on Windows, contains a critical vulnerability that allows arbitrary code execution through improper validation of the ADB binary path. Versions 0.9.26020 and below fail to validate the integrity or authenticity of the ADB binary path specified in the ManualAdbPath setting before executing it, enabling attackers to execute arbitrary code with the privileges of the current user.

Critical Impact

An attacker can craft a malicious App.txt settings file that points ManualAdbPath to an arbitrary executable, achieving remote code execution upon application startup through social engineering tactics.

Affected Products

• ADB Explorer versions 0.9.26020 and below
• Windows systems running vulnerable ADB Explorer versions
• Systems where users can be socially engineered to open malicious shortcuts or archives

Discovery Timeline

• 2026-02-20 - CVE-2026-26959 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26959

Vulnerability Analysis

This vulnerability (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) stems from insufficient validation of user-controlled configuration settings. The application trusts the ManualAdbPath configuration value without verifying that it points to a legitimate ADB binary. When the application starts, it reads the configuration file and directly executes whatever binary is specified in the path, regardless of its origin or integrity.

The attack requires local access and user interaction, typically achieved through social engineering. An attacker can distribute a malicious archive containing a crafted shortcut and configuration file. When a victim extracts and launches the application via the provided shortcut (which includes command-line arguments pointing to the malicious configuration directory), the application loads the attacker-controlled App.txt settings file and executes the malicious binary specified in ManualAdbPath.

Root Cause

The root cause is the lack of binary integrity validation before execution. The application blindly trusts user-supplied configuration paths without performing any verification checks such as:

• Digital signature validation
• SHA-256 hash verification against known-good ADB binaries
• Path canonicalization to prevent directory traversal
• Allowlist-based binary location restrictions

Attack Vector

The attack leverages social engineering combined with a local file-based configuration injection:

1. Attacker creates a malicious executable masquerading as ADB
2. Attacker crafts an App.txt configuration file with ManualAdbPath pointing to the malicious binary
3. Attacker packages these files with a Windows shortcut that launches ADB Explorer with arguments directing it to the malicious configuration directory
4. Victim extracts the archive and clicks the shortcut
5. ADB Explorer loads the malicious configuration and executes the attacker's payload with user privileges

// Security patch adding SHA-256 hash verification regex
         [GeneratedRegex(@"^Version[\t ]*(?<version>[\d.]+)[\s\S]*^Installed as (?<Path>.+)$", RegexOptions.Multiline)]
         public static partial Regex RE_ADB_VERSION();
 
+        [GeneratedRegex(@"EXE SHA-256: (?<Hash>[0-9a-zA-Z]+)$", RegexOptions.Multiline)]
+        public static partial Regex RE_ADB_LIST_HASH();
+
         [GeneratedRegex(@"(?:INSTALL_FAILED_INVALID_APK.*?)(?<package>com\.[\w.]+)(?:])")]
         public static partial Regex RE_PACKAGE_NAME();

Source: GitHub Commit Update

// New AdbVersions.cs implementing hash allowlist for legitimate ADB binaries
+namespace ADB_Explorer.Models;
+
+public static class AdbVersions
+{
+    public static IEnumerable<string> ParseFromVersionList(string versionList)
+    {
+        var matches = AdbRegEx.RE_ADB_LIST_HASH().Matches(versionList);
+
+        foreach (Match match in matches)
+        {
+            if (match.Success)
+            {
+                yield return match.Groups["Hash"].Value.ToUpper();
+            }
+        }
+    }
+
+    public static readonly List<string> HashList = new()
+    {
+        { "56656270DA132F44E9CB4FB86A12BA965635C80423D43DCDD944D9FEC4AB4622" },
+        { "1E1C2280B90B3F01AD84CD8DF4858B1B1995012814F3CA8893BCC3BA3848EDEC" },
+        { "0E606318957BAAC81B997CCD8EE4BCDFF79964A9921DA07C716AEA3E8D856AF7" },
+        { "E1657CA239BCF53F60DD622A8476D51B8DF3C2A3169F7B6082142942560627ED" },
+        { "997324A38D89E3B282306BF25CCAA167C49A35850AC0AB4A169E7A15AFA82FC8" },
+        { "58765259A349CCE392FBB2F15DAB75FED3B7C0B40CC68A7653278B9850602A2F" },
+        { "705DDC21F33AC52105D1B075B019962AD0E44FB3D560BDE69CE8CB3A36BCA183" },
+        { "30C68C1C1A9814A724F47CA544F273B8097263677383046DDB7A0E8C26F7DC60" },
+        { "405852E9A59D31045B7E585BEF2609AE462E5D5ADE6CFEFA2E4FDA9B9C2987F3" },
+        { "BCE1F6F6F6532266837B66D719BFBD177D406D6D7D8D5ADFD5E7C59FCDE651A5" },
+        { "348179B6593CF255BED4F79DF4F298A8D449230F596AE033E29F5D28647803B7" },

Source: GitHub Commit Update

Detection Methods for CVE-2026-26959

Indicators of Compromise

• Presence of suspicious App.txt configuration files in non-standard directories
• ADB Explorer launched with unusual command-line arguments specifying custom configuration paths
• Execution of unknown binaries from unexpected locations referenced by ManualAdbPath
• Archive files containing Windows shortcuts bundled with custom configuration directories

Detection Strategies

• Monitor process creation events for ADB Explorer instances launched with command-line arguments pointing to non-default configuration directories
• Implement file integrity monitoring for ADB Explorer configuration files and detect modifications to ManualAdbPath settings
• Alert on execution of unsigned binaries from user-writable directories immediately following ADB Explorer launch
• Deploy endpoint detection rules to identify shortcut files with suspicious target arguments

Monitoring Recommendations

• Enable Windows process auditing to capture command-line arguments for all process executions
• Configure SentinelOne Singularity to detect process chain anomalies where ADB Explorer spawns unexpected child processes
• Monitor for creation of App.txt files in user-accessible locations outside the standard application data directory
• Track file downloads and archive extractions containing .lnk shortcut files bundled with configuration files

How to Mitigate CVE-2026-26959

Immediate Actions Required

• Update ADB Explorer to version 0.9.26021 or later immediately
• Review and remove any untrusted shortcuts or configuration files associated with ADB Explorer
• Educate users about the risks of opening shortcuts and archives from untrusted sources
• Audit systems for indicators of compromise listed above

Patch Information

The vulnerability has been fixed in ADB Explorer version 0.9.26021. The patch implements SHA-256 hash verification of the ADB binary against a hardcoded allowlist of known legitimate ADB versions before execution. The fix adds the AdbVersions.cs class containing a list of verified SHA-256 hashes and uses regex-based hash extraction to validate binaries. For complete patch details, see the GitHub Security Advisory and release notes for v0.9.26021.

Workarounds

• Avoid launching ADB Explorer from shortcuts or with custom command-line arguments until the patch is applied
• Manually verify that the configured ADB path in settings points to a legitimate Google-provided ADB binary
• Run ADB Explorer in a sandboxed environment or virtual machine when handling untrusted configurations
• Use application allowlisting to prevent execution of unsigned binaries from user-writable directories

# Verify ADB Explorer version and configuration
# Check installed version (should be 0.9.26021 or higher)
# Review App.txt configuration file location and contents
Get-Content "$env:LOCALAPPDATA\ADB Explorer\App.txt" | Select-String "ManualAdbPath"

# Verify ADB binary hash matches known legitimate versions
Get-FileHash "C:\path\to\adb.exe" -Algorithm SHA256