Ajenti: Remote code execution via improper access control (CVE-2026-27975)
Ajenti versions prior to 2.2.13 contain an improper access control vulnerability that allows an unauthenticated remote attacker to execute arbitrary code on the host server.
CVE search metadata
CVE search record: CVE-2026-27975. Severity: critical. CVSS: 9.8. EPSS: 0.59%. KEV: no. Product: ajenti (< 2.2.13). Brief: Ajenti: Remote code execution via improper access control (CVE-2026-27975). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ajenti-rce/
Triage facts
Revision 1- Applicability
- ajenti (< 2.2.13)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 27, 18:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Ajenti contains a high-severity remote code execution vulnerability (CVE-2026-27975) stemming from improper access control (CWE-284). The flaw allows an unauthenticated remote attacker to gain access to the server and execute arbitrary commands. This issue is confirmed fixed in Ajenti version 2.2.13.
Impact
Successful exploitation allows an unauthenticated attacker to achieve full remote code execution on the underlying server, resulting in potential compromise of confidentiality, integrity, and availability.
Recommendation
- Upgrade Ajenti to version 2.2.13 or later immediately.
- Review access logs for any unauthenticated requests to the Ajenti management interface originating from unauthorized or external network segments.
Immediate actions
Upgrade ajenti package to 2.2.13
Threat Hunt
Identify unauthorized or anonymous access attempts to the Ajenti web management interface
Data: Web server access logs (access.log), Authentication logs for Ajenti service
Mitigations
Upgrade ajenti to 2.2.13
CVE-2026-27975