CVE-2026-27174: MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
MajorDoMo contains an unauthenticated remote code execution flaw reachable through the PHP console of its admin panel, as described in the VulnCheck-sourced record. The description attributes it to a missing exit statement after a redirect, which lets unauthenticated requests reach a handler that passes input to eval(). No confirmed exploitation is listed in the sources consulted, and the record lists no fixed version.
Overview
CVE-2026-27174 affects MajorDoMo (also called Major Domestic Module). The record classifies it as code injection (CWE-94) and describes unauthenticated remote code execution through the admin panel PHP console. According to the description, a redirect call without an exit statement lets execution continue past an access check, so unauthenticated requests can reach an AJAX handler that passes user-supplied input to eval().
Impact
- The record scores the issue as critical, with a CVSS base score of 9.8.
- The vector in the record indicates a network-reachable attack that requires no privileges and no user interaction.
- The vector indicates high impact on confidentiality, integrity and availability, meaning arbitrary code execution could expose or alter data and disrupt the host.
Affected products and versions
- The record lists two product names: Mjdm Majordomo and Sergejey MajorDoMo.
- The affected version range is not specified by the source. Treat all installations as potentially in scope until the vendor or project confirms otherwise.
Exploitation status
- The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, so no confirmed active exploitation is recorded in the sources consulted.
- The SSVC exploitation value in the record is proof of concept, and one reference is tagged as exploit-related. Public proof-of-concept material should be assumed to exist.
Remediation and mitigation
- The record lists no fixed version. This does not prove that no fix exists; check the project repository and vendor channels for updates.
- Remove internet exposure of the admin panel and restrict access to trusted internal networks or VPN users.
- Apply access controls in front of the administrative interface, such as network allow lists or an authenticated reverse proxy, as a temporary compensating measure.
- Keep a current inventory of MajorDoMo deployments so exposed instances can be identified quickly.
Detection guidance
- Review web server logs for unexpected requests to administrative endpoints originating from unknown or external sources.
- Look for newly created or modified PHP files in the application tree and for unexpected processes spawned by the web server user.
- Monitor for unusual outbound connections from the application host, which may indicate post-exploitation activity.
Limitations of the available information
- Affected and fixed version ranges are not available in the record.
- No vendor advisory is included in the sources consulted, so patch status for current releases is unknown.
- The record gives no information about how widely MajorDoMo is deployed or how many instances are exposed.
Frequently asked questions
Is CVE-2026-27174 being actively exploited?
The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC value is proof of concept and an exploit-tagged reference exists, so proof-of-concept material should be assumed.
Which MajorDoMo versions are affected?
The sources do not specify affected versions. Check the project and vendor channels to determine whether your installation is in scope.
What should administrators do now?
Remove internet exposure of the admin panel, restrict access to trusted networks, monitor logs for unexpected requests, and watch the project for updates, since the record lists no fixed version.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.