What is the CVSS score of CVE-2026-27180?

CVE-2026-27180 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 61.8%.

Is there a public PoC exploit available for CVE-2026-27180?

Yes, a public proof-of-concept exploit is available for CVE-2026-27180. Prioritise patching immediately. EPSS: 61.8%.

How to fix or mitigate CVE-2026-27180?

Within 24 hours: Identify all MajorDoMo instances in your environment and isolate them from production networks if possible; disable automatic updates immediately and restrict outbound HTTPS connections to known-safe update servers only. Within 7 days: Conduct forensic analysis of update logs to detect any compromise; implement network segmentation to limit lateral movement if breach is confirmed. Within 30 days: Evaluate replacement solutions or develop hardened air-gapped update processes; establish real-time monitoring for suspicious MajorDoMo process behavior.

Majordomo CVE-2026-27180

CRITICAL

Download of Code Without Integrity Check (CWE-494)

2026-02-18 disclosure@vulncheck.com

PHP RCE TLS Majordomo Mjdm

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft HTTP request to /objects/?module=saverestore
Delivery

Bypass authentication via gr('mode') parameter
Exploit

Poison auto_update_settings URL
Execution

Trigger force_update handler
Persist

Fetch malicious Atom feed
Impact

Execute arbitrary code

Vulnerability Assessment

Weakness	CWE CWE-494 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V15 - Secure Coding and Architecture Code integrity verification
Exploitation Conditions	MajorDoMo saverestore module with unauthenticated /objects/?module=saverestore endpoint exposed. No authentication required. Auto-update mechanism enabled and accessible. Attacker controls update feed source or can MITM update URL.
Impact	CVSS 9.8, EPSS 61.8%, PoC available. MajorDoMo is a home automation platform that controls IoT devices including locks, cameras, and HVAC systems. Supply chain compromise of the update mechanism provides persistent, deep access to the home network and all connected smart devices.
Exploit ScenarioDerived	An attacker accesses the unauthenticated saverestore endpoint and modifies the update URL to point to their server. They trigger an update, and MajorDoMo downloads and installs the malicious package. The backdoor provides persistent access to the home automation system, enabling the attacker to control smart locks, disable cameras, and monitor the home.

Emergency Immediate action required. Why: CRITICAL + EPSS > 30%, no patch available.

No patch listed yet 61.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

MajorDoMo home automation platform is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method without authentication due to improper use of gr() (which reads from $_REQUEST), allowing attackers to redirect update URLs and push malicious code packages.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.8

Unauthenticated RCE in MajorDoMo home automation via update URL poisoning in the saverestore module enables supply chain compromise.

RemediationAI

Implement authentication on all saverestore endpoints. Verify update package signatures before installation. Pin update URLs in read-only configuration. Run MajorDoMo in an isolated network segment separate from critical IoT devices.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The saverestore module's admin() method is accessible without authentication because it uses gr('mode') which reads directly from $_REQUEST instead of requiring session validation. An attacker can set the update URL to point to a malicious server, then trigger an update that downloads and installs attacker-controlled code with the application's privileges.

Know when Majordomo gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 20, 2026 - 19:51 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode') (which reads directly from $_REQUEST) instead of the framework's $this->mode. An attacker can poison the system update URL via the auto_update_settings mode handler, then trigger the force_update handler to initiate the update chain. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it using exec('tar xzvf ...'), and copies all extracted files to the document root using copyTree(). This allows an attacker to deploy arbitrary PHP files, including webshells, to the webroot with two GET requests.

Articles & Coverage 2

POC CVE-2026-27180: MajorDoMo Unauthenticated RCE via Update URL Poisoning Feb 19, 2026 vulnerability.circl.lu MajorDoMo Multiple Critical RCE Vulnerabilities (CVE-2026-27174 to CVE-2026-27181) Feb 19, 2026

Executive ViewAI

Why It Matters

MajorDoMo systems are vulnerable to complete remote takeover through poisoned software updates, allowing attackers to execute arbitrary code without authentication. Any organization using MajorDoMo for critical operations faces immediate risk of system compromise, data breach, and operational disruption until mitigation measures are implemented.

Business Impact: Severe

Compensating Controls

Disable automatic update functionality and implement manual update approval processes; restrict MajorDoMo's outbound network access via firewall rules to only approved update domains; implement network segmentation to isolate MajorDoMo systems from sensitive assets; deploy behavioral detection rules for suspicious process execution from MajorDoMo processes; require multi-factor authentication for administrative access to MajorDoMo systems; consider complete air-gapping of MajorDoMo infrastructure until vendor provides patched version.

Threat Intelligence Overview

Threat Score

5.3/10

Composite threat intelligence

EPSS Score

61.8%

Top 2% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS POC (1)

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 61.8%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + EPSS > 30%, no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.