PatchTheCVEmajordomo vulnerabilities and fixes
Recent CVEs affecting majordomo, with upgrade or downgrade steps. 8 tracked.
majordomo has 8 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-02-18. Highest priority: CVE-2026-27175 (score 71/100).
- CVE-2026-27181 HIGH 7.5 MITIGATE MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the marke
- CVE-2026-27180 CRITICAL 9.8 MITIGATE MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply ch
- CVE-2026-27179 HIGH 8.2 MITIGATE MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands
- CVE-2026-27178 HIGH 7.2 MITIGATE MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through metho
- CVE-2026-27177 HIGH 7.2 MITIGATE MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /obje
- CVE-2026-27176 MEDIUM 6.1 MITIGATE MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command
- CVE-2026-27175 CRITICAL 9.8 MITIGATE MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php
- CVE-2026-27174 CRITICAL 9.8 MITIGATE MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP c
FAQ
How do I fix majordomo vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is majordomo being exploited right now?
None of the tracked majordomo CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which majordomo CVE should I patch first?
CVE-2026-27175 currently ranks highest (71/100): MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php.