CVE-2026-27790

EUVD-2026-42001

07.07.2026, 05:16

Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected:





  *  9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))
  *  9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3))
  *  9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5))
  *  9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7))
  *  all versions of 9.10 and prior.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	2.7 LOW	NETWORK	LOW	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 13%

Common Weakness Enumeration

CWE-248 - Uncaught Exception
An exception is thrown from a function, but it is not caught.

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27790