Command Centre Server CVE-2026-26053

Exploitation requires a valid authenticated session with at least a low-privilege operator role on the Gallagher Command Centre Server (confirmed by PR:L in the CVSS vector). The high attack complexity (AC:H) indicates that specific conditions beyond attacker control must align - the exact nature of these conditions (e.g., particular operator role configuration, specific API endpoint state, or race condition) is not disclosed in the available advisory text. Limiting factors: unauthenticated attackers cannot exploit this flaw; only principals with an existing operator account are at risk of abusing it. Exploitation is further constrained to specific version ranges (9.10 all versions; 9.20-9.50 below respective MR thresholds). The physical security domain context means that even limited integrity manipulation could have significant real-world access control implications, so the AC:H constraint should not be dismissed as a reliable long-term barrier.

The NVD CVSS 5.3 score reflects the constrained exploitability: AV:N acknowledges network reachability, but AC:H and PR:L together require both a valid operator credential and specific exploitation conditions to be satisfied simultaneously. The integrity impact is rated high (I:H) with no confidentiality or availability impact (C:N/A:N), suggesting an attacker could alter access rules, cardholder permissions, or system configurations without directly exfiltrating data. No EPSS score was supplied, making probabilistic exploitation likelihood unavailable for comparison. The vulnerability is not in CISA KEV and no POC has been identified, indicating no confirmed mass exploitation. Real-world risk is moderate but context-dependent: in a physical security environment, unauthorized integrity modifications (e.g., unlocking doors, disabling alarms) could have significant operational consequences disproportionate to the numeric CVSS score. Version 9.10 has no patch, elevating risk for organizations still running that branch.

An attacker holding a low-privilege Command Centre operator account - whether an insider, a compromised service account, or a contractor with limited access - crafts a specific sequence of server-side requests that satisfies the high-complexity trigger condition and exploits the incorrect privilege assignment to perform a privileged operation, such as modifying cardholder access rights, altering door unlock schedules, or changing alarm configurations beyond their authorized scope. No public exploit code exists at time of analysis, and the precise trigger mechanism is not publicly disclosed, meaning exploitation currently requires non-trivial knowledge of the platform internals.