What is the CVSS score of CVE-2026-27180?

CVE-2026-27180 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 61.8%.

Which versions of PHP are affected by CVE-2026-27180?

MajorDoMo systems are vulnerable to complete remote takeover through poisoned software updates, allowing attackers to execute arbitrary code without authentication.

Is there a public PoC exploit available for CVE-2026-27180?

Yes, a public proof-of-concept exploit is available for CVE-2026-27180. Prioritise patching immediately. EPSS: 61.8%.

How to fix or mitigate CVE-2026-27180?

Within 24 hours: Identify all MajorDoMo instances in your environment and isolate them from production networks if possible; disable automatic updates immediately and restrict outbound HTTPS connections to known-safe update servers only. Within 7 days: Conduct forensic analysis of update logs to detect any compromise; implement network segmentation to limit lateral movement if breach is confirmed. Within 30 days: Evaluate replacement solutions or develop hardened air-gapped update processes; establish real-time monitoring for suspicious MajorDoMo process behavior.

PHP CVE-2026-27180

CRITICAL

Download of Code Without Integrity Check (CWE-494)

2026-02-18 disclosure@vulncheck.com

PHP TLS RCE Majordomo

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 20, 2026 - 19:51 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode') (which reads directly from $_REQUEST) instead of the framework's $this->mode. An attacker can poison the system update URL via the auto_update_settings mode handler, then trigger the force_update handler to initiate the update chain. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it using exec('tar xzvf ...'), and copies all extracted files to the document root using copyTree(). This allows an attacker to deploy arbitrary PHP files, including webshells, to the webroot with two GET requests.

Articles & Coverage 2

POC CVE-2026-27180: MajorDoMo Unauthenticated RCE via Update URL Poisoning Feb 19, 2026 vulnerability.circl.lu MajorDoMo Multiple Critical RCE Vulnerabilities (CVE-2026-27174 to CVE-2026-27181) Feb 19, 2026

AnalysisAI

MajorDoMo home automation platform is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method without authentication due to improper use of gr() (which reads from $_REQUEST), allowing attackers to redirect update URLs and push malicious code packages.

Technical ContextAI

The saverestore module's admin() method is accessible without authentication because it uses gr('mode') which reads directly from $_REQUEST instead of requiring session validation. An attacker can set the update URL to point to a malicious server, then trigger an update that downloads and installs attacker-controlled code with the application's privileges.

RemediationAI

Implement authentication on all saverestore endpoints. Verify update package signatures before installation. Pin update URLs in read-only configuration. Run MajorDoMo in an isolated network segment separate from critical IoT devices.