{"id":"CVE-2026-27975","kind":"vulnerability","aliases":["CVE-2026-27975","GHSA-vcw3-r3fx-j444"],"related":[],"title":"Ajenti has potential Remote Code Execution","description":"### Impact\n\nAn unauthenticated user could gain access to a server to execute arbitrary code on this server.\n\n### Patches\n\nThis is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.","summary":"Ajenti, a web-based server administration panel, lets an unauthenticated user gain access to the server and run arbitrary code on it. The advisory says the fix is in version 2.2.13, and the flaw is classified as improper access control (CWE-284).","severity":"critical","cvss":9.8,"epss":0.00588,"exploited":false,"exploited_at":null,"products":[{"name":"aj","fixed":["2.2.13"],"affected":"< 2.2.13","ecosystem":"pypi"},{"name":"ajenti","fixed":["2.2.13"],"affected":"< 2.2.13","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-284","package","python","self-hosted","server-admin"],"not_affected_if":["ajenti-not-installed"],"how_to_check":"- Run `pip show aj` and check whether the installed version is below `2.2.13`\n- Check the installed Ajenti version on the server, for example `aj --version` if the command is available, and confirm it is below `2.2.13`","fix":"- Upgrade the `aj` PyPI package to `2.2.13` or later\n- Upgrade the Ajenti vendor package to `2.2.13` or later","status":"open","published_at":"2026-02-26T03:16:05+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","triaged_at":"2026-10-27T13:32:29+00:00","updated_at":"2026-10-27T13:32:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T13:32:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `aj` PyPI package to `2.2.13` or later\n- Upgrade the Ajenti vendor package to `2.2.13` or later","reach":"unknown","title":"Ajenti: unauthenticated users can execute arbitrary code on servers","impact":"high","summary":"Ajenti, a web-based server administration panel, lets an unauthenticated user gain access to the server and run arbitrary code on it. The advisory says the fix is in version 2.2.13, and the flaw is classified as improper access control (CWE-284).","category":"package","nicknames":[],"who_cares":["python","self-hosted","server-admin"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code on the server","analyst_note":"Sources do not say which endpoint or component is vulnerable or how reachable it is over the network; check the GHSA advisory at https://github.com/advisories/GHSA-vcw3-r3fx-j444 for details.","how_to_check":"- Run `pip show aj` and check whether the installed version is below `2.2.13`\n- Check the installed Ajenti version on the server, for example `aj --version` if the command is available, and confirm it is below `2.2.13`","needs_analyst":true,"not_affected_if":["ajenti-not-installed"],"who_is_affected":"Any server running Ajenti before version 2.2.13 is exposed, because the flaw is reachable without logging in. The sources do not say which deployment settings or network exposure make a given install more or less reachable, so unknown. Teams that do not run Ajenti can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000635,"input_tokens":3382,"output_tokens":593,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':8A,16A '-27975':9A,17A '-284':21B,72B '2.2.13':61B,97C 'access':43B,69B,79C 'admin':29B 'administr':36B 'advisori':54B 'aj':18A 'ajenti':1A,19A,30B 'arbitrari':49B,85C 'base':34B 'classifi':66B 'code':5A,50B,86C 'control':70B 'could':77C 'cve':7A,15A 'cwe':20B,71B 'execut':6A,84C 'fix':57B,93C 'flaw':64B 'gain':42B,78C 'ghsa':11A 'ghsa-vcw3-r3fx-j444':10A 'host':26B 'impact':73C 'improp':68B 'j444':14A 'let':38B 'packag':22B 'panel':37B 'patch':90C 'possibl':107C 'potenti':3A 'python':23B 'r3fx':13A 'remot':4A 'run':48B 'say':55B 'self':25B 'self-host':24B 'server':28B,35B,46B,82C,89C 'server-admin':27B 'soon':105C 'unauthent':40B,75C 'upgrad':100C 'user':41B,76C,98C 'vcw3':12A 'version':60B,96C,103C 'web':33B 'web-bas':32B","nicknames":[],"mitigations":[],"who_affected":"Any server running Ajenti before version 2.2.13 is exposed, because the flaw is reachable without logging in. The sources do not say which deployment settings or network exposure make a given install more or less reachable, so unknown. Teams that do not run Ajenti can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-26T03:16:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vcw3-r3fx-j444","url":"https://github.com/advisories/GHSA-vcw3-r3fx-j444","severity":"high","published_at":"2026-10-27T13:27:58+00:00","modified_at":"2026-10-27T13:28:00+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","fetched_at":"2026-10-27T13:31:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-27975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27975","severity":null,"published_at":"2026-02-26T03:16:05+00:00","modified_at":"2026-06-17T10:28:00+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","fetched_at":"2026-10-27T13:31:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}