Login Request a demo
Medium severity · published Jul 7, 2026
CVE-2026-26053
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that…
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Command Centre Server · Gallagher
9.10; 9.50 before vEL9.50.1587(MR1); 9.40 before vEL9.40.3130(MR3); 9.30 before vEL9.30.3983(MR5); 9.20 before vEL9.20.4349(MR7) · source: vendor
CC
Command Centre · Gallagher
before 9.20.4349; 9.30.1594 before 9.30.3983; 9.40.1359 before 9.40.3130; 9.50.978 before 9.50.1587 · source: NVD
Affected product
CC
Command Centre Server
Gallagher
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26053
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26053
Vendor Advisory
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-26053
More from Command Centre Server
9.9
CVE-2025-47699
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site…
8.7
CVE-2024-41724
Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server
8.6
CVE-2026-25193
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only…
8.5
CVE-2024-42407
Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security…
6.7
CVE-2025-48428
Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a…