CVE-2026-15686
Raw vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-15686 is a high-severity Incorrect Check of Function Return Value (CWE-253) vulnerability in Zerodayinitiative (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 37% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-63460
Vulnerability Data
Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability. The specific flaw exists within the multi_query…
more
method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code analysis can discover missing or incorrect return-value checks.
Documented development standards and tools can mandate verified checking of every function return value.
Security engineering principles include requirements for robust error checking of all function returns.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce proper error-handling and return-value checking during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches missing or incorrect return-value checks.
Secure SDLC mandates return-value checks and error handling, directly reducing CWE-253.
Application security requirements include robust error handling that mitigates incorrect return-value checks.
Secure architecture principles require defensive coding practices such as validating function results.
Secure coding explicitly demands checking return values, covering most of CWE-253.