CVE-2026-40177

critical · 9.3

ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.

9.3

CVSS

0.3%

EPSS (exploit prob.)

26th

EPSS percentile

2026-04-10

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
ajenti	ajenti_plugin_core	< 0.112

Check a specific version with /api/v1/cve/match.

References

https://github.com/ajenti/ajenti/security/advisories/GHSA-3mcx-6wxm-qr8v

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-40177