Live › vulnerability › CVE-2026-27975
Go to dashboardAjenti, a web-based server administration panel, lets an unauthenticated user gain access to the server and run arbitrary code on it. The advisory says the fix is in version 2.2.13, and the flaw is classified as improper access control (CWE-284).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 13:31 UTC, 0h before NVD. All times on this page are UTC.
Any server running Ajenti before version 2.2.13 is exposed, because the flaw is reachable without logging in. The sources do not say which deployment settings or network exposure make a given install more or less reachable, so unknown. Teams that do not run Ajenti can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aj | pypi | < 2.2.13 | 2.2.13 |
| ajenti | vendor | < 2.2.13 | 2.2.13 |
pip show aj and check whether the installed version is below 2.2.13aj --version if the command is available, and confirm it is below 2.2.13aj PyPI package to 2.2.13 or later2.2.13 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An unauthenticated user could gain access to a server to execute arbitrary code on this server.
This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.
This page as .md · .json · in your agent: get_signal("CVE-2026-27975")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.