Low severity · published Jul 7, 2026
CVE-2026-27844
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by…
2.7
CVSS
0.4%
EPSS
No
On KEV
Description
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service.
Version of Command Centre affected:
* 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))
* 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3))
* 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5))
* 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7))
* all versions of 9.10 and prior.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C7
Controller 7000 and 6000 · Gallagher
through 9.10; 9.50 before vCR9.50.260616a; 9.40 before vCR9.40.260616a; 9.30 before vCR9.30.260616a; 9.20 before vCR9.20.260616a · source: vendor
CC
Command Centre · Gallagher
before 9.20.4349; 9.30.1594 before 9.30.3983; 9.40.1359 before 9.40.3130; 9.50.978 before 9.50.1587 · source: NVD