How severe is CVE-2026-27174?

CVE-2026-27174 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-27174 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 7% (94th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-27174?

CVE-2026-27174 affects Mjdm Majordomo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-27174?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-27174 have an EU (EUVD) identifier?

Yes. CVE-2026-27174 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-7929.

When was CVE-2026-27174 published?

CVE-2026-27174 was published on 2026-02-18 and last updated on 2026-06-17.

CVE-2026-27174

CVE-2026-27174 is a critical-severity vulnerability in Mjdm Majordomo with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 9.3
EPSS exploit prediction: 7% (94th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-7929
Weakness: CWE-94
Affected product: Mjdm Majordomo
Published: 2026-02-18
Last modified: 2026-06-17

Description

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

Frequently asked questions

What is CVE-2026-27174?: MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.
How severe is CVE-2026-27174?: CVE-2026-27174 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-27174 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 7% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-27174?: CVE-2026-27174 affects Mjdm Majordomo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-27174?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-27174 have an EU (EUVD) identifier?: Yes. CVE-2026-27174 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-7929.
When was CVE-2026-27174 published?: CVE-2026-27174 was published on 2026-02-18 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*

More vulnerabilities in Mjdm Majordomo

CVE-2026-27180 — Critical (CVSS 9.8): MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain…
CVE-2026-27175 — Critical (CVSS 9.8): MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The…
CVE-2023-50917 — Critical (CVSS 9.8): MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE:…
CVE-2026-27179 — High (CVSS 8.2): MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module.…
CVE-2026-27181 — High (CVSS 7.5): MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module.…
CVE-2026-27178 — High (CVSS 7.2): MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method…

All CVEs affecting Mjdm Majordomo →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-76605 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.3 - ???.
CVE-2026-76604 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3 - The…
CVE-2026-67364 — Critical (CVSS 10.0): Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1:…
CVE-2026-73343 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2026-74253 — Critical (CVSS 10.0): Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0…
CVE-2026-73678 — Critical (CVSS 10.0): MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that…

Browse all CWE-94 (Code Injection) vulnerabilities →