What is the CVSS score of CVE-2026-27975?

CVE-2026-27975 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-27975?

Within 24 hours: Identify all Ajenti instances in your environment and isolate affected systems from production networks if patches cannot be immediately applied. Within 7 days: Deploy version 2.2.13 or later across all Ajenti installations and verify successful patching. Within 30 days: Conduct security audit of patched systems, review access logs for potential unauthorized access, and implement network-based access controls restricting Ajenti panel access to trusted administrative networks only.

Ajenti CVE-2026-27975

Q: Which versions of Ajenti are affected by CVE-2026-27975?

A critical vulnerability in Ajenti server administration panels allows unauthenticated attackers to execute arbitrary code remotely, potentially compromising server infrastructure and sensitive data.. A patch is available.

EUVD-2026-8832 CRITICAL

Improper Access Control (CWE-284)

2026-02-26 security-advisories@github.com

GHSA-vcw3-r3fx-j444

Linux Ajenti

9.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send unauthenticated HTTP request to Ajenti panel
Exploit

Bypass authentication mechanism
Impact

Execute arbitrary code on server

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Ajenti versions prior to 2.2.13 with default configuration exposed to network. No authentication required. No special configuration or features needed — direct remote unauthenticated exploitation of authentication bypass vulnerability.
Impact	CVSS 9.8. Server admin panel with RCE = complete server compromise.
Exploit ScenarioDerived	Attacker discovers internet-exposed Ajenti instance, exploits unauthenticated access to execute commands, gains root-equivalent access.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Unauthenticated remote code execution in Ajenti server admin panel before 2.2.13. Unauthenticated users can gain full server access. Patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.8

Unauthenticated RCE in Ajenti server admin panel.

RemediationAI

Update to Ajenti 2.2.13. Restrict admin panel access.

Affected VersionsENISA

ajenti < 2.2.13

Affected Packages

pypi aj fix: 2.2.13

euvd ajenti fix: 2.2.13

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in pypi, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-284 improper access control. Ajenti is a Linux/BSD modular server admin panel — unauthenticated access enables full server control.

Know when Ajenti gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 02, 2026 - 17:24 nvd

Patch available

CVE Published

Feb 26, 2026 - 03:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on aj (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.2.13.

Executive ViewAI

Why It Matters

A critical vulnerability in Ajenti server administration panels allows unauthenticated attackers to execute arbitrary code remotely, potentially compromising server infrastructure and sensitive data. Organizations running Ajenti versions prior to 2.2.13 face immediate risk of unauthorized access and complete system compromise.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not possible, implement emergency mitigations: restrict network access to Ajenti ports (default 8000) to authorized administrator IPs only via firewall rules, disable remote access until patched, deploy WAF rules to block unauthenticated requests to Ajenti endpoints, and monitor logs for exploitation attempts.

Threat Intelligence Overview

EPSS Score

0.1%

Top 68% exploitable

Threat Intel

1 source

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS GHSA

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

More in Ajenti

View all

CVE-2018-1000082 HIGH This Week POC

8.8 Mar 13

Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the

CVE-2018-1000126 HIGH This Week POC

7.5 Mar 13

Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user

CVE-2018-1000081 HIGH This Week POC

7.5 Mar 13

Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can resu

CVE-2018-1000080 MEDIUM This Month POC

6.5 Mar 13

Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The downlo

CVE-2018-18548 MEDIUM This Month POC

6.1 Oct 24

ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in Fi

CVE-2026-79920 CRITICAL Act Now

9.9 Sep 21

Authenticated users of the Ajenti server admin panel - at any privilege level - can achieve root-level code execution an

CVE-2026-40177 CRITICAL Act Now

9.3 Apr 10

Authentication bypass in Ajenti admin panel versions prior to 0.112 allows unauthenticated remote attackers to completel

CVE-2018-1000083 MEDIUM This Month POC

5.3 Mar 13

Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The r

CVE-2014-4301 MEDIUM This Month POC

4.3 Jun 18

Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti

CVE-2014-2260 LOW Monitor POC

3.5 Apr 30

Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows

CVE-2026-40178 MEDIUM This Month

6.9 Apr 10

Remote authentication bypass in Ajenti prior to version 0.112 allows unauthenticated network attackers to circumvent two

Same weakness CWE-284 – Improper Access Control

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2012-4681 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2012-5076 CRITICAL POC

9.8

CVE-2014-3120 HIGH POC

8.1

CVE-2013-2423 LOW POC

3.7

CVE-2016-3427 CRITICAL

9.8

References

Advisories & patches

PATCH https://github.com/ajenti/ajenti/security/advisories/GHSA-vcw3-r3fx-j444 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-27975 REF https://github.com/ajenti/ajenti/releases/tag/v2.2.13

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back