How severe is CVE-2026-26053?

CVE-2026-26053 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-26053 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-26053?

CVE-2026-26053 affects Gallagher Command Centre. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-26053?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-26053 published?

CVE-2026-26053 was published on 2026-07-07 and last updated on 2026-08-18.

CVE-2026-26053

CVE-2026-26053 is a medium-severity vulnerability in Gallagher Command Centre with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-266.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-266
Affected product: Gallagher Command Centre
Published: 2026-07-07
Last modified: 2026-08-18

Description

An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.

Frequently asked questions

What is CVE-2026-26053?: An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.
How severe is CVE-2026-26053?: CVE-2026-26053 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-26053 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-26053?: CVE-2026-26053 affects Gallagher Command Centre. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-26053?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-26053 published?: CVE-2026-26053 was published on 2026-07-07 and last updated on 2026-08-18.

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-26053

Affected products (1)

cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*

More vulnerabilities in Gallagher Command Centre

CVE-2021-23230 — Critical (CVSS 9.9): A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command…
CVE-2021-23140 — Critical (CVSS 9.9): Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an…
CVE-2020-16096 — Critical (CVSS 9.9): In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to…
CVE-2020-16098 — Critical (CVSS 9.8): It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions…
CVE-2019-15294 — Critical (CVSS 9.8): An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service…
CVE-2024-21815 — Critical (CVSS 9.1): Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are…

All CVEs affecting Gallagher Command Centre →

Other CWE-266 (Incorrect Privilege Assignment) vulnerabilities

CVE-2026-39773 — Critical (CVSS 10.0): Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
CVE-2026-105284 — Critical (CVSS 10.0): A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function…
CVE-2026-23800 — Critical (CVSS 10.0): Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue…
CVE-2025-41115 — Critical (CVSS 10.0): SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage…
CVE-2024-9479 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
CVE-2024-9478 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…

Browse all CWE-266 (Incorrect Privilege Assignment) vulnerabilities →