A flaw in Ajenti’s access control permits an unauthenticated user to execute arbitrary code on a server that runs the panel. Because the panel is designed for privileged system management, code execution grants the attacker full control over the host, potentially compromising confidentiality, integrity, and availability. The weakness is a classic example of improper access control, which is recognized as CWE‑284.

The vulnerability applies to all installations of the Ajenti server administration panel that are running a version older than 2.2.13. The affected stack includes Linux and BSD operating systems where Ajenti is deployed through its web‑based interface. The issue is resolved in Ajenti 2.2.13 and later releases.

The CVSS base score of 8.1 indicates a high level of risk, while the EPSS value of less than 1% suggests that exploitation attempts are rare or difficult to detect. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack path involves a remote user accessing the Ajenti web interface without authentication, which can be achieved from any network location that can reach the panel’s listening port. The absence of authentication checks allows the attacker to send specially crafted requests that trigger arbitrary command execution.