Medium severity · published Mar 3, 2026
CVE-2026-20801
Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with…
5.6
CVSS
0.1%
EPSS
No
On KEV
Description
Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with local network access to view live video streams.
This issue affects all versions of Gallagher NxWitness VMS integration prior to 9.10.017 and Gallagher Hanwha VMS integration prior to 9.10.025.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NV
NxWitness VMS and Hanwha VMS Integrations · Gallagher
before 9.10.017; before 9.10.025 · source: vendor
HV
Hanwha Vms Integration · Gallagher
before 9.10.025 · source: NVD
NW
NX Witness Vms Integration · Gallagher
before 9.10.017 · source: NVD
Affected product
NV
NxWitness VMS and Hanwha VMS Integrations
Gallagher