What is the CVSS score of CVE-2026-27174?

CVE-2026-27174 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 60.3%.

Is there a public PoC exploit available for CVE-2026-27174?

Yes, a public proof-of-concept exploit is available for CVE-2026-27174. Prioritise patching immediately. EPSS: 60.3%.

How to fix or mitigate CVE-2026-27174?

Within 24 hours: Identify all systems running MajorDoMo and immediately isolate them from the internet or restrict access to the admin panel via network controls. Within 7 days: Implement compensating controls (WAF rules, IP whitelisting, disable PHP console feature) and conduct forensic analysis for signs of compromise. Within 30 days: Plan migration away from MajorDoMo or replace with a supported alternative, as no patch is currently available.

Majordomo CVE-2026-27174

CRITICAL

Code Injection (CWE-94)

2026-02-18 disclosure@vulncheck.com

PHP RCE Majordomo Mjdm

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted GET request to admin.php
Delivery

Bypass redirect via missing exit statement
Exploit

Reach unauthenticated ajax handler
Execution

Pass PHP code via GET parameter
Impact

Execute arbitrary code via eval()

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	MajorDoMo with PHP console feature enabled in admin panel; register_globals PHP setting active or equivalent parameter injection mechanism; no authentication required for /admin.php access; missing exit statement after redirect() in modules/panel.class.php.
Impact	CVSS 9.8, EPSS 60.3%, PoC available. This is the second critical RCE in MajorDoMo (alongside CVE-2026-27180). Home automation platforms control physical security devices. The missing exit() after redirect() is a classic PHP security anti-pattern.
Exploit ScenarioDerived	An attacker sends a POST request to the panel AJAX endpoint with PHP code. Despite the redirect() call, execution continues and the PHP console evaluates the code. The attacker gains shell access and controls all connected IoT devices including locks, cameras, and alarms.

Emergency Immediate action required. Why: CRITICAL + EPSS > 30%, no patch available.

No patch listed yet 60.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

MajorDoMo home automation platform allows unauthenticated remote code execution through the admin panel's PHP console. An include order bug in panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the PHP code execution functionality in inc_panel_ajax.php.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.8

Unauthenticated RCE in MajorDoMo via PHP console exposed through missing exit after redirect in admin panel authentication.

RemediationAI

Add exit() after all redirect() calls in panel.class.php. Disable the PHP console in production. Implement proper session-based authentication for all admin endpoints. Restrict network access to the management interface.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The panel.class.php module calls redirect() to deny unauthenticated access but does not call exit() afterward. PHP continues executing the remaining code, which reaches the AJAX handler in inc_panel_ajax.php. This handler provides a PHP console feature that executes arbitrary PHP code via eval(). The authentication bypass combined with the console provides complete unauthenticated RCE.

Know when Majordomo gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 20, 2026 - 20:02 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

Articles & Coverage 2

POC CVE-2026-27174: Unauthenticated RCE in MajorDomo Admin Panel PHP Console Feb 26, 2026 vulnerability.circl.lu MajorDoMo Multiple Critical RCE Vulnerabilities (CVE-2026-27174 to CVE-2026-27181) Feb 19, 2026

Executive ViewAI

Why It Matters

MajorDoMo installations are vulnerable to unauthenticated remote code execution through an exposed PHP console, allowing attackers to gain complete system control without credentials. This critical vulnerability poses an immediate threat to any organization running this software, with active exploits already in circulation.

Business Impact: Severe

Compensating Controls

Implement network segmentation to restrict admin panel access to trusted IPs only; deploy WAF rules to block requests to the PHP console endpoint; disable the PHP console feature entirely if operationally feasible; require VPN access for any administrative functions; implement intrusion detection signatures for exploitation attempts; monitor access logs for suspicious activity; consider immediate decommissioning of the affected systems pending vendor patch availability.

Threat Intelligence Overview

Threat Score

5.3/10

Composite threat intelligence

EPSS Score

60.3%

Top 2% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS POC (2)

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 60.3%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + EPSS > 30%, no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.