{"vulnerability": "CVE-2026-27180", "sightings": [{"uuid": "c7b6f00f-30f0-4e60-8dc6-55b0188308c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-27180", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mf5zmgksbs2n", "content": "", "creation_timestamp": "2026-02-18T21:30:16.158854Z"}, {"uuid": "1a2b4759-539d-422c-9310-bfafaf167faa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-27180", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116093761184172626", "content": "", "creation_timestamp": "2026-02-18T21:30:18.199590Z"}, {"uuid": "b94efb67-d33f-4277-9dd3-f1054d783f57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27180", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mf64cshlt32s", "content": "", "creation_timestamp": "2026-02-18T22:18:34.074805Z"}, {"uuid": "430a747e-f33c-422a-95fe-3549700fb256", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27180", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/majordomo_supply_chain_rce.rb", "content": "", "creation_timestamp": "2026-03-02T10:29:55.000000Z"}, {"uuid": "8c44ebba-d150-4023-bf8d-c21e500ef7c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27180", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mg6o5kgzx423", "content": "", "creation_timestamp": "2026-03-03T21:02:58.977814Z"}, {"uuid": "178abcca-666b-4587-881d-48153bf0626d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-27180", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/42521e67-5c8d-4b16-a114-e0db686c91a7", "content": "", "creation_timestamp": "2026-02-19T10:22:00.000000Z"}, {"uuid": "df20413b-9eb0-4cca-aff3-28e0459db067", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27180", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/majordomo_supply_chain_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code execution vulnerability in\\n          MajorDoMo's saverestore module via supply chain poisoning. The saverestore module's\\n          admin() method is reachable without authentication through the /objects/?module=saverestore\\n          endpoint because usual() calls admin() directly and uses gr() (which reads from $_REQUEST)\\n          instead of $this->mode for mode checks.\\n\\n          Two unauthenticated GET requests chain together for full RCE:\\n          1. auto_update_settings - poisons the MASTER_UPDATE_URL to point to an attacker-controlled server\\n          2. force_update - triggers autoUpdateSystem() which fetches an Atom feed and tarball from the\\n          poisoned URL, extracts the tarball, and copies all files to the webroot via copyTree()\\n\\n          The tarball is downloaded via curl with CURLOPT_SSL_VERIFYPEER set to FALSE and no integrity\\n          check. The attacker serves a fake Atom feed with an entry older than the configured delay\\n          (default 1 day) and a tarball containing a PHP webshell. After deployment, the module\\n          executes the payload through the webshell.\\n\\n          All versions of MajorDoMo up to and including the latest release are affected.\\n          The fix is tracked in PR sergejey/majordomo#1177.\", \"disclosure_date\": \"2026-02-18\", \"fullname\": \"exploit/multi/http/majordomo_supply_chain_rce\", \"is_install_path\": true, \"mod_time\": \"2026-02-27 14:42:00 +0000\", \"name\": \"MajorDoMo Supply Chain RCE via Update Poisoning\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/majordomo_supply_chain_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/majordomo_supply_chain_rce\", \"references\": [\"CVE-2026-27180\", \"URL-https://chocapikk.com/posts/2026/majordomo-revisited/\", \"URL-https://github.com/sergejey/majordomo/pull/1177\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:01.363094Z"}]}