What is the CVSS score of CVE-2026-27174?

CVE-2026-27174 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 60.3%.

Which versions of PHP are affected by CVE-2026-27174?

MajorDoMo installations are vulnerable to unauthenticated remote code execution through an exposed PHP console, allowing attackers to gain complete system control without credentials.

Is there a public PoC exploit available for CVE-2026-27174?

Yes, a public proof-of-concept exploit is available for CVE-2026-27174. Prioritise patching immediately. EPSS: 60.3%.

How to fix or mitigate CVE-2026-27174?

Within 24 hours: Identify all systems running MajorDoMo and immediately isolate them from the internet or restrict access to the admin panel via network controls. Within 7 days: Implement compensating controls (WAF rules, IP whitelisting, disable PHP console feature) and conduct forensic analysis for signs of compromise. Within 30 days: Plan migration away from MajorDoMo or replace with a supported alternative, as no patch is currently available.

PHP CVE-2026-27174

CRITICAL

Code Injection (CWE-94)

2026-02-18 disclosure@vulncheck.com

PHP RCE Majordomo

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 20, 2026 - 20:02 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

Articles & Coverage 2

POC CVE-2026-27174: Unauthenticated RCE in MajorDomo Admin Panel PHP Console Feb 26, 2026 vulnerability.circl.lu MajorDoMo Multiple Critical RCE Vulnerabilities (CVE-2026-27174 to CVE-2026-27181) Feb 19, 2026

AnalysisAI

MajorDoMo home automation platform allows unauthenticated remote code execution through the admin panel's PHP console. An include order bug in panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the PHP code execution functionality in inc_panel_ajax.php.

Technical ContextAI

The panel.class.php module calls redirect() to deny unauthenticated access but does not call exit() afterward. PHP continues executing the remaining code, which reaches the AJAX handler in inc_panel_ajax.php. This handler provides a PHP console feature that executes arbitrary PHP code via eval(). The authentication bypass combined with the console provides complete unauthenticated RCE.

RemediationAI

Add exit() after all redirect() calls in panel.class.php. Disable the PHP console in production. Implement proper session-based authentication for all admin endpoints. Restrict network access to the management interface.