CVE-2026-26053
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform operations they would not normally be authorized to do. Affected versions: 9.50 prior to MR1, 9.40 prior to MR3, 9.30 prior to MR5, 9.20 prior to MR7, and all versions of 9.10.
Risk Assessment
The risk involves potential privilege escalation by an operator, leading to unauthorized access to sensitive system functions, potentially compromising data integrity and confidentiality.
Recommendation
Immediately update Command Centre Server to versions: 9.50 MR1, 9.40 MR3, 9.30 MR5, 9.20 MR7 or later. For version 9.10, migrate to a supported version.
Other vulnerabilities in Command Centre Server
See all- CVE-2026-20757Low
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. Affected versions: 9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), and all versions of 9.00 and prior.
- CVE-2025-64734Low
A Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the reader to perform a denial-of-service attack against that specific reader, preventing cardholders from badging for entry. This issue affects Command Centre Server versions 9.30 prior to vCR9.30.251028a, 9.20 prior to vCR9.20.251028a, 9.10 prior to vCR9.10.251028a, and all versions of 9.00 and prior.
- CVE-2025-52578Medium
High Sec ELM contains an Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE-335) vulnerability that may allow a sophisticated attacker with physical access to compromise internal device communications. This issue affects Command Centre Server versions 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), and all versions of 9.00 and prior.
- CVE-2025-52457Medium
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server versions 9.30 prior to vCR9.30.251028a, 9.20 prior to vCR9.20.251028a, 9.10 prior to vCR9.10.251028a, and all versions of 9.00 and prior.
- CVE-2025-48430Medium
Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
- CVE-2025-41402Medium
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.
- CVE-2025-35981Medium
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6).
Original NVD description (English source)
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS