Ajenti CVE-2026-40178

CVSS 6.9 with CVSS v4.0 vector AV:N/AC:H reflects a network-accessible vulnerability with high attack complexity, requiring either timing precision or specific conditions to exploit-the AC:H modifier is critical and substantially reduces real-world exploitability compared to lower-complexity vulnerabilities. EPSS data is not provided, but the high attack complexity, lack of confirmed active exploitation status (KEV status unknown), and absence of public exploit code substantially mitigate the calculated CVSS score. The vulnerability does carry high confidentiality and integrity impact (VC:H/VI:H), confirming that successful exploitation grants unauthorized system access. However, the combination of high complexity and the fact that 2FA is an opt-in security feature (affecting only deployments with 2FA enabled) suggests this is a real but not critical-priority vulnerability for most organizations. Organizations with 2FA-enabled Ajenti instances should prioritize patching, while those without 2FA face no risk from this specific issue.

An attacker with network access to an Ajenti web interface monitors or predicts the narrow time window immediately after a legitimate user authenticates with their primary credentials but before the 2FA challenge is enforced. By sending a crafted request during this interval-either through precise timing or by exploiting a race condition in the session state machine-the attacker gains authenticated access without providing valid secondary authentication factors. No public exploit code has been identified at the time of analysis, but the timing-dependent nature of the vulnerability means that discovery and weaponization are plausible if the authentication flow contains exploitable logic gaps.