{"vulnerability": "CVE-2026-27175", "sightings": [{"uuid": "9686fbce-9ea9-46ce-ac4a-4e687759d07e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-27175", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mf66nevy4q2o", "content": "", "creation_timestamp": "2026-02-18T23:00:16.636270Z"}, {"uuid": "d323b7d0-cf42-4d46-b1dc-9806c3e8c4f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-27175", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116094115117047754", "content": "", "creation_timestamp": "2026-02-18T23:00:28.592762Z"}, {"uuid": "9ab81c84-2b33-4a00-a670-18519449a526", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27175", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mf6ag3prxe2c", "content": "", "creation_timestamp": "2026-02-18T23:31:59.578034Z"}, {"uuid": "c2f33528-6039-47b5-b88e-72d00d32597d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27175", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/majordomo_cmd_injection_rce.rb", "content": "", "creation_timestamp": "2026-03-02T10:29:55.000000Z"}, {"uuid": "650f9a42-1975-4464-8ab8-35c0be6839cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27175", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mg6o5k3vfw2h", "content": "", "creation_timestamp": "2026-03-03T21:02:58.205709Z"}, {"uuid": "ed7cbe2a-ee6b-4f42-837d-c3b290c17305", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-27175", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/42521e67-5c8d-4b16-a114-e0db686c91a7", "content": "", "creation_timestamp": "2026-02-19T10:22:00.000000Z"}, {"uuid": "4c920c58-f89b-47b4-b5a2-da2b96338980", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27175", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mjfrbmlmau27", "content": "", "creation_timestamp": "2026-04-13T21:03:11.186578Z"}, {"uuid": "b58a91b8-8131-4748-ba90-9d0ffac3b201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27175", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/majordomo_cmd_injection_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated command injection vulnerability in MajorDoMo's\\n          remote command handler (rc/index.php). The param parameter is interpolated into double\\n          quotes without escapeshellarg(), and the resulting string is passed to safe_exec() which\\n          inserts it into the safe_execs database table with no sanitization.\\n\\n          The cycle_execs.php worker script is web-accessible without authentication. On startup it\\n          purges the safe_execs queue, then enters an infinite loop polling the table every second\\n          and passing each command to exec(). A race condition is required: the worker must be\\n          started first (which purges existing entries), then the injection is performed while the\\n          worker is polling. The next iteration picks up and executes the attacker's payload.\\n\\n          The command parameter must reference a valid .bat file in rc/commands/. The default\\n          MajorDoMo installation ships with shutdown.bat, displayon.bat, and displayoff.bat.\\n\\n          All versions of MajorDoMo up to and including the latest release are affected.\\n          The fix is tracked in PR sergejey/majordomo#1177.\", \"disclosure_date\": \"2026-02-18\", \"fullname\": \"exploit/multi/http/majordomo_cmd_injection_rce\", \"is_install_path\": true, \"mod_time\": \"2026-02-27 14:42:00 +0000\", \"name\": \"MajorDoMo Remote Command Injection via cycle_execs Race Condition\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/majordomo_cmd_injection_rce.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/majordomo_cmd_injection_rce\", \"references\": [\"CVE-2026-27175\", \"URL-https://chocapikk.com/posts/2026/majordomo-revisited/\", \"URL-https://github.com/sergejey/majordomo/pull/1177\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:01.192012Z"}]}