CVE Explorer
CVE-2026-27844
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service.
Version of Command Centre affected:
* 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))
* 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3))
* 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5))
* 9
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Controller 7000 and 6000","vendor":"Gallagher","versions":[{"lessThanOrEqual":"9.10","status":"affected","version":"0","versionType":"custom"},{"lessThan":"vCR9.50.260616a","status":"affected","version":"9.50","versionType":"custom"},{"lessThan":"vCR9.40.260616a","status":"affected","version":"9.40","versionType":"custom"},{"lessThan":"vCR9.30.260616a","status":"affected","version":"9.30","versionType":"custom"},{"lessThan":"vCR9.20.260616a","status":"affected","version":"9.20","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:7b6ab7e7fd2429c6fc4866bd4c70f2d5a29c398cbe7c7ce5a5c327fc550966fa · sha256:da4aada3a9814528… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:7b6ab7e7fd2429c6fc4866bd4c70f2d5a29c398cbe7c7ce5a5c327fc550966fa · sha256:da4aada3a9814528… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-248","description":"CWE-248 Uncaught exception","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:7b6ab7e7fd2429c6fc4866bd4c70f2d5a29c398cbe7c7ce5a5c327fc550966fa · sha256:da4aada3a9814528… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"url":"https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27844"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7b6ab7e7fd2429c6fc4866bd4c70f2d5a29c398cbe7c7ce5a5c327fc550966fa · sha256:da4aada3a9814528… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.