CVE-2026-27975 ยท GHSA-vcw3-r3fx-j444
Ajenti has potential Remote Code Execution
- Risk score
- 78/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 26 Feb 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Ajenti has a potential Remote Code Execution vulnerability, allowing an unauthenticated user to execute arbitrary code on the server. An attacker could exploit this to gain control of the server.
- Affected
- {'products': ['Ajenti'], 'packages': [{'ecosystem': 'pip', 'name': 'aj', 'vulnerable': '< 2.2.13'}], 'versions': ['< 2.2.13']}
- Fix
- Upgrade to version 2.2.13 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| aj | pip | < 2.2.13 | 2.2.13 |
References
Original description
Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.
Last activity 27 Oct 2026. Patch Forecast updates every hour.