Ajenti vulnerabilities
Published CVEs affecting Ajenti products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-40178
Medium · 5.9
CWE-287 Apr 10, 2026
ajenti.plugin.core has a race conditions in 2FA
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. This vulnerability is fixed in 0.112.
CVE-2026-40177
High · 7.5
CWE-287 Apr 10, 2026
Password bypass when 2FA is activated
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.
CVE-2026-35175
Medium · 6.5
CWE-862 Apr 6, 2026
Ajenti has an authorization bypass during custom package installation
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
CVE-2026-27975
Critical · 9.8
CWE-284 Feb 26, 2026
Ajenti has a potential Remote Code Execution
Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.