# CVE-2026-27844: Gallagher Controller 6000 and 7000 denial of service in diagnostic web interface

Source: https://junglewise.ai/threats/cve-2026-27844-gallagher-controller-6000-and-7000-denial-of-service-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-27844 · Severity: low · CVSS 2.7 · Published 2026-07-07

Gallagher Controller 6000 and 7000 devices, which manage physical access control and security systems, contain a vulnerability in their diagnostic web interface. An authorized user with high-level permissions could intentionally or accidentally cause the controller to restart by sending specific web requests. This results in a temporary service outage where security functions managed by the controller may be unavailable until the device finishes rebooting.

Vendors: [Gallagher](https://junglewise.ai/threats/vendors/gallagher).

## Quick answers

**Is CVE-2026-27844 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27844 being exploited in the wild.

**How severe is CVE-2026-27844?** Low severity, with a CVSS score of 2.7, published 7 July 2026.

**Which products and versions are affected?** Gallagher Controller 6000 Command Centre 9.50 prior to vCR9.50.260616a, 9.40 prior to vCR9.40.260616a, 9.30 prior to vCR9.30.260616a, 9.20 prior to vCR9.20.260616a, and all versions 9.10 and prior; Gallagher Controller 7000 Command Centre 9.50 prior to vCR9.50.260616a, 9.40 prior to vCR9.40.260616a, 9.30 prior to vCR9.30.260616a, 9.20 prior to vCR9.20.260616a, and all versions 9.10 and prior.

**Is there a fix for CVE-2026-27844?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-27844 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-27844?** Check whether you run Gallagher Controller 6000 or Gallagher Controller 7000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as an Uncaught Exception (CWE-248) exists within the diagnostic web interface of Gallagher Controller 6000 and 7000 hardware. An authenticated and authorized operator can trigger this exception by sending specifically crafted requests to the diagnostic interface, leading to a software crash and subsequent controller restart. This results in a temporary denial of service (DoS). The attack requires network access to the diagnostic interface and high privileges (PR:H). Gallagher recommends disabling the diagnostic web interface via physical DIP switches or software configuration as a primary mitigation. Patches are available in Command Centre maintenance releases for versions 9.20 through 9.50.

## Affected products

- Gallagher Controller 6000 Command Centre 9.50 prior to vCR9.50.260616a, 9.40 prior to vCR9.40.260616a, 9.30 prior to vCR9.30.260616a, 9.20 prior to vCR9.20.260616a, and all versions 9.10 and prior
- Gallagher Controller 7000 Command Centre 9.50 prior to vCR9.50.260616a, 9.40 prior to vCR9.40.260616a, 9.30 prior to vCR9.30.260616a, 9.20 prior to vCR9.20.260616a, and all versions 9.10 and prior

## Timeline

- 2026-07-07: advisory
- 2026-07-07: disclosed

## References

- [https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27844](https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27844)