Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-27975: Ajenci allows attackers to run code on your server
CVE-2026-27975 · published today
Summary
The Ajenci web control panel can be accessed by anyone without a password, letting them run any commands on the server. This could let malicious users take full control of your system. Install the updated version 2.2.13 right away to close the issue.
What to do
- Update aj to version 2.2.13.
- Update ajenti ajenti to version 2.2.13 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | ajenti | ajenti |
< 2.2.13 cpe:2.3:a:ajenti:ajenti:*:*:*:*:*:*:*:* |
| pip | – | aj |
< 2.2.13 Fix: upgrade to 2.2.13
|
Original advisory text
Ajenti has potential Remote Code Execution
### Impact
An unauthenticated user could gain access to a server to execute arbitrary code on this server.
### Patches
This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.
An unauthenticated user could gain access to a server to execute arbitrary code on this server.
### Patches
This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.
References
- https://github.com/ajenti/ajenti/releases/tag/v2.2.13
- https://github.com/ajenti/ajenti/security/advisories/GHSA-vcw3-r3fx-j444
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27975... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27975
- https://github.com/advisories/GHSA-vcw3-r3fx-j444
- https://github.com/ajenti/ajenti Product
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-284Improper Access Control
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen6 Mar 2026
Sources
CVE-2026-27975 · NVD
CVE-2026-27975 · OSV
GHSA-vcw3-r3fx-j444 · GHSA
GHSA-vcw3-r3fx-j444 · OSV
Track software like this
Free during beta