CVE-2025-43960: Adminer · Deserialization of Untrusted Data
Source CVE Database V5
Not known to be exploited · CVSS 8.6 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 54% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 25 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, organizations should first verify if their Adminer installations use Monolog for logging and identify if they are running version 4.8.1. Immediate steps include disabling or restricting access to Adminer interfaces from untrusted networks to reduce exposure to unauthenticated remote attacks. Implementing web application firewalls (WAFs) with rules to detect and block suspicious serialized payloads can help prevent exploitation attempts. Administrators should monitor server memory usage and set resource limits to prevent excessive memory consumption by PHP processes. Applying input validation and sanitization on serialized data before deserialization is critical; if possible, replace unsafe deserialization with safer alternatives or use libraries that enforce strict type and size checks. Organizations should track vendor advisories for patches or updates addressing this issue and apply them promptly once available. Additionally, logging and alerting on anomalous requests containing large serialized strings can aid in early detection of exploitation attempts. Regular backups and incident response plans should be updated to handle potential DoS incidents caused by this vulnerability.
Description
Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention.