CVE-2026-27180

CVE-2026-27180 is a critical unauthenticated remote code execution vulnerability affecting MajorDoMo (Major Domestic Module) due to supply chain compromise via update URL poisoning. An attacker can manipulate the system update URL, trigger a forced update, and then deliver malicious code through a tarball downloaded with disabled TLS verification and extracted to the webroot. This vulnerability has a CVSS score of 9.8 (Critical), indicating it can be exploited remotely with low complexity to achieve complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 14 mentions, suggesting high awareness among security researchers.