VulnSocial

CVE-2026-79920Patch

LOWCVSS 9.9 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 6 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 5 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 4 mentions (2026-09-22); latest day: 1
  • 6 total mentions across 3 days

Deep dive

Activity timeline6 mentions / 3d
01234Mentions · 2026-09-22: 4Mentions · 2026-09-24: 1Mentions · 2026-10-14: 1PoC Mentioned / Linked · 2026-09-22: 1Patch / Workaround · 2026-09-22: 2Patch / Workaround · 2026-10-14: 1Technical Details · 2026-09-22: 3Technical Details · 2026-09-24: 1Technical Details · 2026-10-14: 109-2209-2410-14
Signal classification3 categories
Patch
350.0%
Disclosure
233.3%
General
116.7%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-224
Disclosure1General1Patch2
2026-09-241
Disclosure1
2026-10-141
Patch1
Full discourse6 posts
  • VulnTracker@vuln_tracker
    Patch

    Any logged-in Ajenti user can trigger a pip install running as root (CVSS 9.9). CVE-2026-79920 skips plugin-management authorization entirely. A low-privileged user can queue an install/uninstall/upgrade task, and since pip runs as root on unvalidated package name and version fields, that's a straight path to full host compromise. Fixed in ajenti 2.2.16. Update now. Details: http://vulntracker.io/cves/CVE-2026-79920 #Ajenti #CVE #InfoSec #CyberSecurity #PrivilegeEscalation

    Post summary

    The post discloses CVE-2026-79920, a privilege escalation flaw in Ajenti allowing logged-in users to run pip as root, notes it is fixed in version 2.2.16, and urges users to update.

    00041139
    832 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 Ajenti'de CVE-2026-79920 — CVSS 9.9 Kritik Güvenlik Açığı! Ajenti adlı sunucu yönetim panelinin<2.2.16 sürümlerini etkileyen kritik yetkilendirme açığı, düşük yetkili kimliği doğrulanmış kullanıcıların plugin yükleme/kaldırma/güncelleme işlemlerini yetkisiz şekilde başlatmasına izin veriyor. Bu açık nedeniyle işlemler root yetkileriyle gerçekleştirilebiliyor, sunucuda kod çalıştırılabiliyor. Ajenti 2.2.16+ sürümüne mutlaka güncelleme yapın.

    Post summary

    The text discloses CVE-2026-79920 (CVSS 9.9 authorization bypass in Ajenti <2.2.16 allowing root code execution) and primarily urges users to upgrade to 2.2.16+; no PoC, exploit tool, or active exploitation evidence is mentioned.

    10031430
    2.5K followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    [CVE] CVE-2026-79920 [HIGH PRIORITY] #Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin ... 🔗 https://exploitgrid.net/cve/CVE-2026-79920

    Post summary

    The tweet announces CVE-2026-79920, a privilege escalation vulnerability in Ajenti, and links to a PoC page, but lacks details on exploitation or remediation.

    1000028
    203 followersView on X
  • ExploitGrid@exploitgrid
    General

    🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-77521 CVE-2026-79920 CVE-2026-82187 CVE-2026-85751 CVE-2026-94301 ..🧵👇

    Post summary

    The text only lists CVE identifiers in a daily digest format without providing specific context, exploitation details, or remediation information.

    1000055
    203 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-79920 Ajenti 9.9: any authenticated user can reach root code execution via /api/core/tasks/start - pip runs as root on unvalidated plugin names. Patch still under review, so restrict access until 2.2.16 lands. https://www.valtersit.com/cve/CVE-2026-79920/ #CVE #infosec #Ajenti #Ajenti #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text discloses CVE-2026-79920 in Ajenti 9.9, detailing an authenticated root code execution vector via unvalidated plugin names in pip, and advises restricting access as a workaround until the patched version 2.2.16 is released.

    0000050
    1.1K followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen Ajenti: Kritische Rechteausweitung bis Root in Server-Admin-Panel behoben #ajenti #bsd #cve202679920 #linux #privilegeescalation #remotecodeexecution #serveradminpanel https://cybersecurity-news.de/ajenti-cve-2026-79920-root-codeausfuehrung

    Post summary

    The tweet discloses a critical privilege escalation (CVE‑2026‑79920) in Ajenti's server admin panel that can lead to remote code execution as root. It notes the vulnerability has been fixed, though no specific patch details are provided.

    0000045
    15 followersView on X

Explore more

Back to dashboard