CVE-2026-27844

Published: Jul 7, 2026Modified: Aug 14, 2026

2.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Exploitability: 1.2 / Impact: 1.4

Source: disclosures@gallagher.com (Secondary)

Description

Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)) * 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)) * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)) * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)) * all versions of 9.10 and prior.

Affected (4)

Products: Gallagher: Command Centre

Gallagher

1 product

Command Centre

Configuration A

4 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Gallagher Command Centre	version < 9.20.4349
Gallagher Command Centre	9.30.1594 ≤ version < 9.30.3983
Gallagher Command Centre	9.40.1359 ≤ version < 9.40.3130
Gallagher Command Centre	9.50.978 ≤ version < 9.50.1587

Running on/with	Platform Versions
Gallagher Controller 6000	All versions
Gallagher Controller 7000	All versions
Gallagher Controller 7000 Enhanced	All versions
Gallagher Controller 7000 High Security	All versions
Gallagher Controller 7000 Single Door	All versions
Gallagher Controller 7000 Two Door	All versions

Related CWEs

CWE-248

Uncaught Exception

An exception is thrown from a function, but it is not caught.

References (1)

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27844

Source: disclosures@gallagher.com

Vendor Advisory

Timeline

No history available yet.