Genetec Security Center CVE-2026-27768

Exploitation requires an authenticated session with high privileges - specifically, an account assigned the Access Manager role within Genetec Security Center (CVSS PR:H confirmed). Attack complexity is high (AC:H), indicating that beyond authentication, additional non-default conditions or race-condition-like circumstances must be met; the exact nature of this complexity is not specified in the available CVE description and should be verified against Genetec's advisory. The vulnerability is network-accessible (AV:N), so physical or local access to the host is not required. No user interaction is needed (UI:N) once the attacker has authenticated. Exploitation is explicitly classified as not automatable by SSVC, ruling out scripted mass exploitation. Factors that limit exploitation include: the high privilege prerequisite (Access Manager role must be compromised or held by the attacker), the high complexity condition (unknown specific trigger beyond authentication), and the absence of any public exploit code or reported active exploitation at time of analysis.

The CVSS base score of 6.6 accurately reflects a nuanced risk profile: while CIA impact is rated high across all three dimensions (C:H/I:H/A:H), the attack vector prerequisites substantially constrain real-world exploitation. Privileges required are high (PR:H), limiting potential exploiters to accounts already assigned the Access Manager role, and attack complexity is high (AC:H), implying additional conditions beyond authentication must be met - the exact nature of which is not explicitly specified in available data. EPSS at 0.03% (8th percentile) reflects an extremely low probability of exploitation in the near term, fully consistent with SSVC's 'Exploitation: none' assessment. SSVC further classifies the attack as not automatable, ruling out opportunistic or scripted mass exploitation. There is no CISA KEV listing and no public exploit code identified. The primary realistic threat model is an insider with legitimately elevated privileges or an attacker who has already compromised a high-privilege account - not an external opportunistic attacker. The 'Technical Impact: total' SSVC flag warrants remediation but does not elevate this to an emergency-priority finding for most organizations. No conflicting signals are present across the available data sources.

An attacker who has obtained or compromised a Genetec Security Center account with the Access Manager role - whether through credential theft, privilege escalation from a lower-privileged compromise, or insider access - navigates to an access control management function and injects malicious SQL syntax into an input field processed by the Access Manager component. The crafted payload manipulates the underlying database query to exfiltrate sensitive cardholder records, modify door access permissions, or corrupt database state, achieving full impact on the physical security system's data layer. No public exploit code has been identified at time of analysis, making this scenario most plausible in targeted, post-compromise, or insider threat contexts rather than opportunistic attack campaigns.