CVE-2026-27174 affects MajorDoMo due to an include order bug in modules/panel.class.php where execution continues after a redirect() call lacking an exit statement. This flaw allows unauthenticated requests to reach inc_panel_ajax.php's ajax handler. The console handler in this file uses user-supplied GET parameters passed via register_globals directly to eval() without authentication, enabling remote code execution. An attacker can exploit this by sending crafted GET requests with ajax_panel, op, and command parameters to /admin.php, resulting in arbitrary PHP code execution.

This vulnerability allows unauthenticated remote attackers to execute arbitrary PHP code on the affected MajorDoMo server. This can lead to full system compromise, data theft, service disruption, or further attacks within the network. The CVSS 4.0 score of 9.3 reflects the critical severity and ease of exploitation without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the admin panel and disable or restrict the PHP console feature if possible. Monitor for unusual requests targeting /admin.php with ajax_panel parameters and consider implementing web application firewall rules to block suspicious inputs.