What is the CVSS score of CVE-2026-27975?

CVE-2026-27975 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ajenti are affected by CVE-2026-27975?

A critical vulnerability in Ajenti server administration panels allows unauthenticated attackers to execute arbitrary code remotely, potentially compromising server infrastructure and sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-27975?

Within 24 hours: Identify all Ajenti instances in your environment and isolate affected systems from production networks if patches cannot be immediately applied. Within 7 days: Deploy version 2.2.13 or later across all Ajenti installations and verify successful patching. Within 30 days: Conduct security audit of patched systems, review access logs for potential unauthorized access, and implement network-based access controls restricting Ajenti panel access to trusted administrative networks only.

Ajenti CVE-2026-27975

CRITICAL

Improper Access Control (CWE-284)

2026-02-26 security-advisories@github.com

Linux Ajenti

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 02, 2026 - 17:24 nvd

Patch available

CVE Published

Feb 26, 2026 - 03:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.

AnalysisAI

Unauthenticated remote code execution in Ajenti server admin panel before 2.2.13. Unauthenticated users can gain full server access. Patch available.

Technical ContextAI

CWE-284 improper access control. Ajenti is a Linux/BSD modular server admin panel — unauthenticated access enables full server control.

RemediationAI

Update to Ajenti 2.2.13. Restrict admin panel access.

More in Ajenti

View all

CVE-2018-1000082 HIGH This Week POC

8.8 Mar 13

Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the

CVE-2018-1000126 HIGH This Week POC

7.5 Mar 13

Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user

CVE-2018-1000081 HIGH This Week POC

7.5 Mar 13

Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can resu

CVE-2018-1000080 MEDIUM This Month POC

6.5 Mar 13

Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The downlo

CVE-2026-40177 CRITICAL Act Now

9.3 Apr 10

Authentication bypass in Ajenti admin panel versions prior to 0.112 allows unauthenticated remote attackers to completel

CVE-2018-1000083 MEDIUM This Month POC

5.3 Mar 13

Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The r

CVE-2014-4301 MEDIUM This Month POC

4.3 Jun 18

Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti

CVE-2014-2260 LOW Monitor POC

3.5 Apr 30

Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows

CVE-2026-40178 MEDIUM This Month

6.9 Apr 10

Remote authentication bypass in Ajenti prior to version 0.112 allows unauthenticated network attackers to circumvent two

Same weakness CWE-284 – Improper Access Control

View all

CVE-2012-4681 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2012-5076 CRITICAL POC

9.8

CVE-2014-3120 HIGH POC

8.1

CVE-2013-2423 LOW POC

3.7

CVE-2016-3427 CRITICAL

9.8

CVE-2025-12480 CRITICAL POC

9.1

CVE-2026-27975 vulnerability details – vuln.today

Back

Ajenti CVE-2026-27975

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Ajenti

Same weakness CWE-284 – Improper Access Control

Share

External POC / Exploit Code