High severity · published Apr 10, 2026
CVE-2026-40177
Password bypass when 2FA is activated
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AJ
ajenti · ajenti
< 0.112 · source: vendor
AP
Ajenti Plugin Core · Ajenti
before 0.112 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40177
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40177
Vendor Advisory
https://github.com/ajenti/ajenti/security/advisories/GHSA-3mcx-6wxm-qr8v
More from ajenti
9.9
CVE-2026-79920
Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task
9.8
CVE-2026-27975
Ajenti has a potential Remote Code Execution
8.8
CVE-2019-25066
ajenti API privileges management
8.8
CVE-2018-1000082
Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage the server
7.5
CVE-2018-1000126
Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the…