CVE-2026-27790 Overview
CVE-2026-27790 is an uncaught exception vulnerability [CWE-248] affecting Gallagher T20 Readers managed by Gallagher Command Centre. An authenticated and authorized operator can send specific requests that trigger a reader restart, causing a temporary denial of service on the affected device. The flaw requires high privileges and no user interaction, and it impacts only availability. Gallagher has published fixed component releases across multiple Command Centre branches to address the issue.
Critical Impact
An authenticated operator with valid privileges can force T20 Readers to restart by sending crafted requests, temporarily disrupting physical access control operations.
Affected Products
- Gallagher Command Centre 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))
- Gallagher Command Centre 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)), 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)), and 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7))
- All versions of Gallagher Command Centre 9.10 and prior (T20 Readers)
Discovery Timeline
- 2026-07-07 - CVE-2026-27790 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-27790
Vulnerability Analysis
The vulnerability resides in the request handling logic of the Gallagher T20 Reader firmware component distributed with Command Centre. When the reader processes certain request patterns, an exception is raised but not caught by the surrounding handler. The unhandled exception propagates to the top of the execution stack and forces the reader firmware to restart. During the restart interval, the reader is unavailable to authenticate credentials or grant access, producing a temporary denial of service on that physical access endpoint.
The issue is classified under CWE-248: Uncaught Exception. Exploitation requires the attacker to already hold a valid operator account with authorization to interact with the reader subsystem. This constraint limits the practical attack surface to insiders or attackers who have already compromised an operator credential.
Root Cause
The root cause is missing exception handling around specific request-processing code paths in the T20 Reader. The firmware does not validate or catch the abnormal condition triggered by the crafted request, so the runtime terminates and reinitializes the device instead of rejecting the request and continuing normal operation.
Attack Vector
The attack is delivered over the network from an authenticated operator session in Command Centre. No user interaction is required. The attacker issues the specific request pattern targeting the T20 Reader, causing it to restart. Repeated requests can extend the outage window and disrupt door access, though confidentiality and integrity of stored data are not affected.
No public proof-of-concept, exploit code, or exploitation in the wild has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-27790
Indicators of Compromise
- Unexpected restart events logged by T20 Readers without correlating maintenance activity or power events
- Gaps in reader availability or credential authentication events for specific doors during otherwise normal operating hours
- Operator sessions issuing repeated, atypical requests directed at reader endpoints prior to reader restarts
Detection Strategies
- Correlate Command Centre operator audit logs with T20 Reader restart events to identify operators whose activity precedes unavailability
- Alert on repeated reader restart events from the same reader or cluster of readers within a short time window
- Baseline normal operator request patterns and flag deviations that target reader management endpoints
Monitoring Recommendations
- Forward Command Centre and reader diagnostic logs to a centralized SIEM or data lake for retention and correlation
- Monitor firmware and Command Centre component versions across the estate to confirm patched builds are deployed
- Track operator account activity, especially privileged operator accounts with authorization to interact with readers
How to Mitigate CVE-2026-27790
Immediate Actions Required
- Upgrade Gallagher Command Centre to a build that distributes the fixed T20 Reader component (vCR9.50.260616a, vCR9.40.260616a, vCR9.30.260616a, or vCR9.20.260616a or later)
- Review and reduce the population of operator accounts with authorization to interact with readers, following least-privilege principles
- Enforce strong authentication on all operator accounts and rotate credentials suspected of compromise
Patch Information
Gallagher has released fixed component versions for supported Command Centre branches. Version 9.10 and prior are not receiving a fix for this issue and should be upgraded to a supported branch. Refer to the Gallagher Security Advisory CVE-2026-27790 for the authoritative list of fixed versions and upgrade guidance.
Workarounds
- Restrict network access to Command Centre and reader management interfaces to trusted administrative networks only
- Audit operator role assignments and remove reader management privileges from accounts that do not require them
- Increase monitoring of reader availability metrics so that induced restarts are detected and investigated quickly
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
