How severe is CVE-2026-27174?

CVE-2026-27174 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-27174 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 7% (93rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-27174?

CVE-2026-27174 affects Mjdm Majordomo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-27174?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-27174 have an EU (EUVD) identifier?

Yes. CVE-2026-27174 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-7929.

When was CVE-2026-27174 published?

CVE-2026-27174 was published on 2026-02-18 and last updated on 2026-06-17.

CVE-2026-27174

CVE-2026-27174 is a critical-severity vulnerability in Mjdm Majordomo with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 9.3
EPSS exploit prediction: 7% (93rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-7929
Weakness: CWE-94
Affected product: Mjdm Majordomo
Published: 2026-02-18
Last modified: 2026-06-17

Description

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

Frequently asked questions

What is CVE-2026-27174?: MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.
How severe is CVE-2026-27174?: CVE-2026-27174 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-27174 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 7% (93rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-27174?: CVE-2026-27174 affects Mjdm Majordomo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-27174?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-27174 have an EU (EUVD) identifier?: Yes. CVE-2026-27174 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-7929.
When was CVE-2026-27174 published?: CVE-2026-27174 was published on 2026-02-18 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*

More vulnerabilities in Mjdm Majordomo

CVE-2026-27180 — Critical (CVSS 9.8): MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain…
CVE-2026-27175 — Critical (CVSS 9.8): MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The…
CVE-2023-50917 — Critical (CVSS 9.8): MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE:…
CVE-2026-27179 — High (CVSS 8.2): MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module.…
CVE-2026-27181 — High (CVSS 7.5): MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module.…
CVE-2026-27178 — High (CVSS 7.2): MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method…

All CVEs affecting Mjdm Majordomo →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Browse all CWE-94 (Code Injection) vulnerabilities →