CVE-2026-27844 Gallagher CVE debrief

Who should care

Security teams responsible for Gallagher Command Centre versions 9.50 prior to vCR9.50.260616a, 9.40 prior to vCR9.40.260616a, 9.30 prior to vCR9.30.260616a, 9.20 prior to vCR9.20.260616a, and all versions of 9.10 and prior should prioritize patching.

Technical summary

The vulnerability, classified as CWE-248 Uncaught Exception, allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests to the diagnostic web interface of Controller 6000 and Controller 7000. This results in a temporary denial of service. Affected Command Centre versions include 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)), 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)), 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)), 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)), and all versions of 9.10 and prior.

Defensive priority

Low priority due to CVSS score of 2.7 and limited impact.

Recommended defensive actions

• Apply patches for affected Command Centre versions
• Verify authentication and authorization controls
• Monitor for suspicious requests to the diagnostic web interface
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited; verify vulnerability details with Gallagher security advisories. The vulnerability is classified as CWE-248 Uncaught Exception. An authenticated and authorized operator can trigger a Controller restart by sending specific requests to the diagnostic web interface of Controller 6000 and Controller 7000, resulting in a temporary denial of service. Limited evidence is available; defenders should verify affected scope and vendor guidance.

Official resources