Ajenti has potential Remote Code Execution

CRITICAL 9.8CVE-2026-27975 · GHSA-vcw3-r3fx-j444 · Published 26/02/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
aj PyPI	`< 2.2.13`	`2.2.13`
ajenti ajenti	`< 2.2.13`	`2.2.13`

Description

Impact

An unauthenticated user could gain access to a server to execute arbitrary code on this server.

Patches

This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.

NVD description

Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.

References

ajenti/ajenti security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-27975 · ADVISORY
ajenti/ajenti · PACKAGE
ajenti/ajenti release v2.2.13 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free