CVE-2026-27174
Published: 18 February 2026
Summary
CVE-2026-27174 is a critical-severity Code Injection (CWE-94) vulnerability in Mjdm Majordomo. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-27174 is a critical remote code execution vulnerability in MajorDoMo (also known as Major Domestic Module), an open-source home automation platform. The flaw affects the admin panel's PHP console feature due to an include order bug in modules/panel.class.php, which allows execution to proceed past a redirect() call lacking an exit statement. This permits unauthenticated requests to reach the ajax handler in inc_panel_ajax.php, where user-supplied input from GET parameters is passed directly to eval() without authentication checks, exacerbated by the use of register_globals.
Any unauthenticated remote attacker can exploit this vulnerability by sending a crafted GET request to /admin.php with the ajax_panel, op, and command parameters containing arbitrary PHP code. Successful exploitation results in full remote code execution on the affected server, providing complete control over the system. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-94 (Improper Control of Generation of Code).
Advisories and patches are available via referenced sources, including a detailed technical post at https://chocapikk.com/posts/2026/majordomo-revisited/, a fix pull request at https://github.com/sergejey/majordomo/pull/1177, and a VulnCheck advisory at https://www.vulncheck.com/advisories/majordomo-unauthenticated-remote-code-execution-via-admin-console-eval. Security practitioners should consult these for specific mitigation guidance, such as applying the upstream patch.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7929
Vulnerability details
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to…
more
reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote code execution via a public-facing web application (admin panel), directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific flaws: include order bug, missing exit after redirect, lack of authentication checks, and unsafe eval of user input from GET parameters.
Enforces authentication and authorization to block unauthenticated remote access to the vulnerable admin panel ajax handler in inc_panel_ajax.php.
Validates and sanitizes user-supplied GET parameters (ajax_panel, op, command) before processing to prevent arbitrary PHP code execution via eval.