CVE-2026-27975: Ajenti has a potential Remote Code Execution
Impact
An unauthenticated user could gain access to a server to execute arbitrary code on this server.
Patches
This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.
Other sources
Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/ajto a version that resolves this vulnerability.Fixed in 2.2.13 - Upgrade
Upgrade
Ajentito a version that resolves this vulnerability.Fixed in 2.2.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27975?
CVE-2026-27975 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-27975?
To fix CVE-2026-27975, upgrade Ajenti to version 2.2.13 or later.
Who is affected by CVE-2026-27975?
CVE-2026-27975 affects all versions of Ajenti prior to 2.2.13.
What can an attacker do with CVE-2026-27975?
An attacker exploiting CVE-2026-27975 can execute arbitrary code on the affected server.
Is CVE-2026-27975 remote or local?
CVE-2026-27975 is a remote vulnerability, allowing unauthenticated users to exploit it from outside the server.