CVE-2026-27844: Controller 6000/7000 DoS Vulnerability

CVE-2026-27844 is a denial of service vulnerability in Controller 6000 and 7000 diagnostic web interface caused by an uncaught exception. Authenticated operators can trigger controller restarts. This article covers technical details, affected Command Centre versions, impact assessment, and mitigation strategies.

CVE-2026-27844 Overview

CVE-2026-27844 is an uncaught exception vulnerability [CWE-248] in the Gallagher Controller 6000 and Controller 7000 diagnostic web interface. An authenticated and authorized operator can send specific requests that trigger a Controller restart. The restart produces a temporary denial of service on the affected access control hardware.

The issue affects multiple Command Centre release branches. Fixed builds are distributed through maintenance releases across the 9.20, 9.30, 9.40, and 9.50 branches. All 9.10 and earlier versions remain vulnerable and require an upgrade.

Critical Impact
An authorized operator can cause a temporary denial of service by restarting the Controller through crafted diagnostic web interface requests.

Affected Products

Gallagher Command Centre 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))
Gallagher Command Centre 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)), 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)), and 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7))
Gallagher Command Centre 9.10 and all prior versions (no fix available; upgrade required)

Discovery Timeline

2026-07-07 - CVE-2026-27844 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-27844

Vulnerability Analysis

The vulnerability resides in the diagnostic web interface exposed by the Controller 6000 and Controller 7000. The interface fails to catch an exception raised while processing specific request inputs. The unhandled exception propagates and terminates the Controller process, forcing a restart.

The Controller 6000 and Controller 7000 provide access control and alarm monitoring functions in Gallagher Command Centre deployments. A restart interrupts door control, cardholder authentication, and alarm processing until the device returns to service. Availability is degraded only for the duration of the restart cycle.

Exploitation requires network access to the diagnostic interface and valid operator credentials with sufficient authorization. The attack does not yield code execution, privilege escalation, or data disclosure. Impact is limited to temporary availability loss on the targeted Controller.

Root Cause

The root cause is an uncaught exception [CWE-248] in the request-handling logic of the diagnostic web interface. The code path lacks defensive error handling for the malformed or edge-case inputs that produce the exception. Without a handler, the runtime terminates the affected process instead of returning an error response.

Attack Vector

An authenticated operator with diagnostic access sends the specific request over the network to the Controller's web interface. The Controller processes the request, raises the exception, and restarts. Repeated requests can be used to prolong the disruption on a targeted device. Gallagher's advisory contains the definitive technical description. See the Gallagher Security Advisory CVE-2026-27844 for details.

Detection Methods for CVE-2026-27844

Indicators of Compromise

Unplanned Controller restarts recorded in Command Centre event logs without a corresponding administrator action or firmware update
Diagnostic web interface requests from operator accounts immediately preceding Controller offline events
Repeated availability gaps on a single Controller correlated with authenticated operator sessions

Detection Strategies

Correlate Controller offline and online events with authentication and request logs from the diagnostic web interface
Alert on operator accounts that access the diagnostic interface outside of change windows or maintenance schedules
Baseline normal restart frequency per Controller and flag deviations that exceed the baseline

Monitoring Recommendations

Forward Command Centre audit logs and Controller health telemetry to a centralized SIEM for correlation
Monitor operator session activity against role expectations, flagging diagnostic actions by accounts that do not normally perform them
Track patch state of every Controller and Command Centre server against the fixed build numbers listed in the vendor advisory

How to Mitigate CVE-2026-27844

Immediate Actions Required

Upgrade Command Centre to a fixed build: 9.50.1587(MR1), 9.40.3130(MR3), 9.30.3983(MR5), or 9.20.4349(MR7) or later
Migrate 9.10 and earlier deployments to a supported, patched branch, as no fix is available for those versions
Review operator role assignments and remove diagnostic web interface permissions from accounts that do not require them

Patch Information

Gallagher has released fixes across supported branches. Apply the Controller firmware distributed with the maintenance releases identified above. Refer to the Gallagher Security Advisory CVE-2026-27844 for full upgrade instructions and download locations.

Workarounds

Restrict network access to the Controller diagnostic web interface using firewall rules or network segmentation
Limit the number of operator accounts granted diagnostic privileges and audit those accounts regularly
Enforce strong authentication and session controls on all Command Centre operator accounts