Gallagher Controller 6000/7000 CVE-2026-27844

Exploitation requires an account that is both authenticated and explicitly authorized as an operator within Gallagher Command Centre - this maps to the CVSS PR:H (high privilege) designation. The attacker must have network-level access to the diagnostic web interface of the Controller 6000 or 7000. The target controller must be running an unpatched version of Command Centre firmware within the affected version ranges (9.20-9.50 pre-patch, or 9.10 and earlier). Exploitation is limited to the specific diagnostic web interface endpoint; standard access control operations on other interfaces are not affected. Limiting factors: no exploitation is possible without valid high-privilege operator credentials; the DoS is temporary (controller restarts and resumes service); and versions of Command Centre 9.10 and below lack patches, making them permanently vulnerable until upgraded.

The CVSS 3.1 score of 2.7 (Low) accurately reflects the constrained real-world risk. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L indicates network-accessible exploitation requiring high-privilege (authenticated and authorized operator) credentials, with impact limited to low-severity availability disruption. No EPSS data was provided in the input; given the niche product footprint and high privilege requirement, exploitation probability would be expected to be very low. There is no CISA KEV listing and no public proof-of-concept. The practical threat model is almost exclusively insider misuse or a scenario where an operator account has been compromised. The temporary nature of the DoS (a controller restart rather than a persistent outage) further reduces severity. The only notable aggravating factor is the operational context: in a physical security deployment, a controller restart at a critical access point (e.g., a hospital, data center, or government facility) could briefly disable physical access controls, which may carry consequences disproportionate to the CVSS score in high-security environments. CVSS vector is internally consistent with the description - no conflicts detected.

An authenticated operator with a valid high-privilege account on the Gallagher Command Centre system navigates to the Controller 6000 or 7000 diagnostic web interface and sends a specially crafted HTTP request that triggers an unhandled exception in the controller firmware. The controller process terminates and restarts, temporarily interrupting physical access enforcement at all doors or checkpoints managed by that controller - potentially allowing tailgating or lockout at a critical access point during the restart window.