CVE-2026-27975 is a critical flaw in Ajenti, a Linux and BSD server admin panel. NVD scores it 9.8: before version 2.2.13, an unauthenticated user could gain access to the server and run arbitrary code. The fix is Ajenti 2.2.13. Upgrade and keep the panel off the open internet.
What's affected
The GitHub advisory GHSA-vcw3-r3fx-j444, published on 25 February 2026, says versions before 2.2.13 are affected and 2.2.13 is the patched release. The advisory lists no package name and no weakness identifier, which is why NVD's mapping uses CWE-284 (Improper Access Control).
The v2.2.13 release notes, dated 24 February, describe two security fixes: more checks on headers, and cache isolation that is also time limited. The advisory itself does not say how those relate to the flaw, so this post does not guess.
Ajenti is an administration panel. By design it can manage services, files and users on the host, which is why an access flaw in it is more serious than the same flaw in an ordinary web app.
How to check if you're exposed
Find out whether you run Ajenti and which version. Check the version shown in the panel itself, or ask the package manager or installer you used to set it up. Any version below 2.2.13 is affected.
Also check network exposure. List which hosts answer on the panel's port from outside your management network, using your firewall rules or an external scan of your own address space. The advisory does not specify a port, so use the one in your own configuration.
What to do now
- Upgrade Ajenti to 2.2.13 or later.
- Restrict the panel to a management network, VPN or allow list. Admin panels should not be reachable from the open internet.
- If you cannot upgrade today, take the panel offline or block it at the firewall until you can.
- Review host logs and recent changes on any server that exposed an older Ajenti to untrusted networks. The advisory gives no indicators, so look for unexpected users, services and scheduled tasks.
- Record Ajenti in your asset inventory so future advisories are matched to the hosts that run it.
Why it matters
The advisory is short, and the key sentence is this: an unauthenticated user could gain access to a server and execute arbitrary code on it. No login and no user interaction are required, which is how NVD reaches 9.8.
The class is improper access control. A control that should stop strangers from reaching privileged functions did not do so under some conditions. For a server admin panel, the privileged functions are the ones that matter most, because the panel runs with the power to change the machine.
The record does not flag exploitation in the wild, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog. The practical lesson is older than this CVE. Management interfaces belong on private networks. If a flaw like this appears, network restriction is what stands between a published advisory and your server.
Quick check
Which Ajenti version fixes CVE-2026-27975?
2.2.13. The advisory says versions before 2.2.13 are affected.
Is a firewall enough instead of upgrading?
It lowers exposure a lot, but it is a stopgap. Upgrade as well, since anyone who reaches the panel from inside the network could still be a risk.
Sources
Last reviewed: 19 October 2026.
