What is the CVSS score of CVE-2026-27175?

CVE-2026-27175 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 41.7%.

Which versions of PHP are affected by CVE-2026-27175?

MajorDoMo installations are vulnerable to complete system compromise through unauthenticated remote code execution with a 41.7% exploitation probability.

Is there a public PoC exploit available for CVE-2026-27175?

Yes, a public proof-of-concept exploit is available for CVE-2026-27175. Prioritise patching immediately. EPSS: 41.7%.

How to fix or mitigate CVE-2026-27175?

Within 24 hours: Identify all MajorDoMo instances in your environment and isolate them from production networks or disable external access immediately. Within 7 days: Deploy compensating controls (WAF rules blocking rc/index.php parameter injection, network segmentation restricting access to trusted IPs only). Within 30 days: Evaluate alternative home automation solutions and plan migration away from MajorDoMo, or await vendor patch availability and validate thoroughly before deployment.

PHP CVE-2026-27175

CRITICAL

OS Command Injection (CWE-78)

2026-02-18 disclosure@vulncheck.com

PHP RCE Command Injection Race Condition Majordomo

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 20, 2026 - 20:02 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.

Articles & Coverage 1

vulnerability.circl.lu MajorDoMo Multiple Critical RCE Vulnerabilities (CVE-2026-27174 to CVE-2026-27181) Feb 19, 2026

AnalysisAI

Unauthenticated OS command injection in MajorDoMo via rc/index.php. EPSS 41.7% — the $param variable is passed unsanitized to shell commands. PoC available.