CVE-2026-27844
Last modified
CVE-2026-27844 is a low-severity vulnerability rated 2.7/10 on the CVSS scale. Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)) * 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)) * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)) * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)) * all versions of 9.10 and prior.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)) * 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)) * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)) * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)) * all versions of 9.10 and prior.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Gallagher | Controller 7000 and 6000 | <= 9.10; >= 9.50, < vCR9.50.260616a; >= 9.40, < vCR9.40.260616a; >= 9.30, < vCR9.30.260616a; >= 9.20, < vCR9.20.260616a |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-27844?
How severe is CVE-2026-27844?
How do I fix CVE-2026-27844?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27839wger is a free, open-source workout and fitness manager. In …4.3
- CVE-2026-2784Mitigation bypass in the DOM: Security component. This vulne…9.8
- CVE-2026-27840ZITADEL is an open source identity management platform. Star…4.3
- CVE-2026-27841A vulnerability in SenseLive X3050's web management interfac…8.4
- CVE-2026-27842Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A…9.8
- CVE-2026-27843A vulnerability exists in SenseLive X3050's web management i…9.2
- CVE-2026-27846Due to missing authentication, a user with physical access t…6.2
- CVE-2026-27847Due to improper neutralization of special elements, SQL stat…9.8
- CVE-2026-27848Due to missing neutralization of special elements, OS comman…9.8
- CVE-2026-27849Due to missing neutralization of special elements, OS comman…9.8
- CVE-2026-2785Invalid pointer in the JavaScript Engine component. This vul…9.8
- CVE-2026-27850Due to an improperly configured firewall rule, the router wi…7.5
Are you affected by CVE-2026-27844?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST