What is the CVSS score of CVE-2026-55727?

CVE-2026-55727 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Genetec Security Center are affected by CVE-2026-55727?

Genetec Security Center 5.14.0.0 (builds prior to 5.14.178.18) contains an authentication bypass allowing unauthenticated remote access to live video streams, exposing surveillance footage to…. A patch is available.

How to fix or mitigate CVE-2026-55727?

Within 24 hours: Audit all Genetec Security Center deployments to identify vulnerable builds (5.14.0.0 through 5.14.178.17); immediately restrict network access to video stream endpoints to trusted administrative networks only via firewall rules. Within 7 days: Implement network segmentation isolating video services; enable and monitor authentication logs for unauthorized stream access attempts; deploy network sensors to detect suspicious stream request patterns. Within 30 days: Contact Genetec for patched build 5.14.178.18 or later availability; execute immediate upgrade upon release; evaluate supplementary video transport encryption where supported.

Genetec Security Center CVE-2026-55727

EUVD-2026-41923 HIGH

Improper Authentication (CWE-287)

2026-07-06 Genetec

GHSA-3hmc-px3x-2cjr

Authentication Bypass Genetec Security Center Genetec Inc

7.5

CVSS 3.1 · Vendor: Genetec

Severity by source

Vendor (Genetec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network request retrieves live video (AV:N/PR:N/UI:N, C:H); no integrity or availability impact and no scope change, so I:N/A:N/S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Genetec).

CVSS VectorVendor: Genetec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 06, 2026 - 22:02 EUVD

Analysis Generated

Jul 06, 2026 - 21:03 vuln.today

DescriptionCVE.org

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.

AnalysisAI

Unauthenticated video stream access in Genetec Security Center 5.14.0.0 (builds prior to 5.14.178.18) lets remote attackers pull live video feeds by exploiting a flaw in the authentication mechanism that guards video stream requests. Because the CVSS vector is AV:N/PR:N/UI:N, no credentials or user interaction are needed, and the CWE-287 root cause means the stream endpoint fails to properly verify the requester's identity. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided.

Technical ContextAI

Genetec Security Center is a unified physical-security platform combining video management (Omnicast), access control (Synergis) and license-plate recognition; the affected component here is the live video retrieval path. The single CPE provided (cpe:2.3:a:genetec_inc.:genetec_security_center:*:*:*:*:*:*:*:*) is version-wildcarded, so it does not itself bound the affected range - the description does that (5.14.0.0 up to but not including build 5.14.178.18). The root cause is classified as CWE-287 (Improper Authentication): the authorization check that should gate video stream requests can be bypassed or is not enforced, allowing a client that has not proven its identity to receive the media stream. This typically arises when a streaming endpoint trusts a session token, URL parameter, or handshake step that can be omitted or forged.

RemediationAI

Upgrade Genetec Security Center 5.14.0.0 to build 5.14.178.18 or later, which is the vendor-fixed build (Vendor-released patch: 5.14.178.18); consult the Genetec advisory at https://resources.genetec.com/security-advisories/vulnerability-affecting-live-video-retrieval-in-security-center-5-14-0-0 for the exact download and any build-specific guidance. Until the update is applied, restrict network reachability of the video streaming services to trusted management hosts only - place the Security Center servers on an isolated VLAN and use firewall rules to block the video stream ports from general user and internet-facing networks, accepting that this narrows but does not eliminate exposure for insiders on the same segment. Because the impact is unauthorized viewing of live streams (no integrity/availability loss), monitoring of unexpected stream client connections and tightening of network ACLs are reasonable compensating controls, but they do not substitute for the patch since the underlying authentication check remains bypassable.