# CVE-2026-20757: Gallagher Command Centre Server improper locking in Morpho integration

Source: https://junglewise.ai/threats/cve-2026-20757-gallagher-command-centre-server-improper-locking-in-morpho  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20757 · Severity: low · CVSS 2.5 · Published 2026-03-03

Gallagher Command Centre Server is a critical component of enterprise access control and security management systems. A locking vulnerability in the Morpho biometric integration allows a privileged operator to cause temporary unavailability of the system, potentially disrupting access control operations at a facility.

Technologies: [Gallagher Command Centre Server](https://junglewise.ai/threats/technologies/command-centre-server). Vendors: [Gallagher](https://junglewise.ai/threats/vendors/gallagher).

## Quick answers

**Is CVE-2026-20757 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20757 being exploited in the wild.

**How severe is CVE-2026-20757?** Low severity, with a CVSS score of 2.5, published 3 March 2026.

**Which products and versions are affected?** Gallagher Command Centre Server 9.40 prior to 9.40.1976 MR1, 9.30 prior to 9.30.3382 MR4, 9.20 prior to 9.20.3783 MR6, 9.10 prior to 9.10.4647 MR9, 9.00 and all prior versions.

**Is there a fix for CVE-2026-20757?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20757 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-20757?** Check whether you run Gallagher Command Centre Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper locking vulnerability (CWE-667) exists in the Gallagher Morpho biometric integration component within Command Centre Server. The vulnerability allows a user with privileged operator credentials to trigger a limited denial-of-service condition. The attack requires local access, high attack complexity, and valid operator privileges. The impact is limited to temporary availability disruption with no impact on confidentiality or integrity. Patches are available across all affected versions: 9.40.1976 MR1, 9.30.3382 MR4, 9.20.3783 MR6, 9.10.4647 MR9, and all versions after 9.00.

## Affected products

- Gallagher Command Centre Server 9.40 prior to 9.40.1976 MR1, 9.30 prior to 9.30.3382 MR4, 9.20 prior to 9.20.3783 MR6, 9.10 prior to 9.10.4647 MR9, 9.00 and all prior versions

## Timeline

- 2026-03-03: disclosed

## References

- [https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-20757](https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-20757)

## Related threats

- [Gallagher Command Centre incorrect privilege assignment in Server](https://junglewise.ai/threats/cve-2026-26053-gallagher-command-centre-incorrect-privilege-assignment-in-server)
- [Gallagher Command Centre credential exposure in service installers](https://junglewise.ai/threats/cve-2026-25193-gallagher-command-centre-credential-exposure-in-service)