---
id: "CVE-2026-27975"
kind: "vulnerability"
aliases: ["CVE-2026-27975", "GHSA-vcw3-r3fx-j444"]
title: "Ajenti has potential Remote Code Execution"
severity: "critical"
cvss: 9.8
epss: 0.00588
exploited: false
status: "open"
category: "package"
products: [{"name": "aj", "fixed": ["2.2.13"], "affected": "< 2.2.13", "ecosystem": "pypi"}, {"name": "ajenti", "fixed": ["2.2.13"], "affected": "< 2.2.13", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cwe-284", "package", "python", "self-hosted", "server-admin"]
not_affected_if: ["ajenti-not-installed"]
published_at: "2026-02-26T03:16:05+00:00"
first_seen_at: "2026-10-27T13:31:05+00:00"
updated_at: "2026-10-27T13:32:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-vcw3-r3fx-j444", "first_seen_at": "2026-10-27T13:31:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27975", "first_seen_at": "2026-10-27T13:31:51+00:00"}]
---

# Ajenti has potential Remote Code Execution

Ajenti, a web-based server administration panel, lets an unauthenticated user gain access to the server and run arbitrary code on it. The advisory says the fix is in version 2.2.13, and the flaw is classified as improper access control (CWE-284).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:aj affected < 2.2.13 fixed 2.2.13
- vendor:ajenti affected < 2.2.13 fixed 2.2.13

## How to check

- Run `pip show aj` and check whether the installed version is below `2.2.13`
- Check the installed Ajenti version on the server, for example `aj --version` if the command is available, and confirm it is below `2.2.13`

## Fix

- Upgrade the `aj` PyPI package to `2.2.13` or later
- Upgrade the Ajenti vendor package to `2.2.13` or later

## Timeline

- 2026-10-27T13:31:05+00:00 ghsa https://github.com/advisories/GHSA-vcw3-r3fx-j444
- 2026-10-27T13:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-27975

## From the sources

### Impact

An unauthenticated user could gain access to a server to execute arbitrary code on this server.

### Patches

This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_