Command Centre Server vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

CC

Product

Command Centre Server

by Gallagher · last CVE Jul 7, 2026

16

CVEs

0

On KEV

9.9

Max CVSS

0

New 30D

Vulnerabilities16 In the news0 Timeline

Severity mix

Critical 1High 4Medium 10Low 1

Severity

All severities16 Critical1 High4 Medium10 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Command Centre Server to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-47699	9.9	0%	Oct 23	Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site… Affected: through 8.90; 9.30 before 9.30.2482 (MR2); 9.20 before 9.20.2819 (MR4); 9.10 before 9.10.3672 (MR7; 9.00 before 9.00.3831 (MR8)
CVE-2024-41724	8.7	0%	Mar 10	Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server Affected: before 9.20.1043
CVE-2026-25193	8.6	0%	May 25	Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only… Affected: 9.40 before 9.40.2575 (MR2)
CVE-2024-42407	8.5	0%	Dec 12	Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security… Affected: through 8.80; 9.10 before 9.10.2149 (MR4); 9.00 before 9.00.2374 (MR5); 8.90 before 8.90.2356 (MR6)
CVE-2024-43690	8.0	1%	Sep 11	Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE) Affected: through 8.70; 9.10 before vEL9.10.1530(MR2); 9.00 before vEL9.00.2168 (MR4); 8.90 before vEL8.90.2155 (MR5); 8.80 before vEL8.80.1938 (MR6)
CVE-2025-48428	6.7	0%	Oct 23	Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a… Affected: through 8.90; 9.20 before 9.20.2819 (MR4); 9.10 before 9.10.3672 (MR7); 9.00 before 9.00.3831 (MR8)
CVE-2024-21815	6.5	0%	Mar 5	Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users Affected: through 8.60; 9.00 before vEL9.00.1774 (MR2); 8.90 before vEL8.90.1751 (MR3); 8.80 before vEL8.80.1526 (MR4); 8.70 before vEL8.70.2526 (MR6)
CVE-2025-46406	5.6	0%	Jul 10	A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged… Affected: through 8.90; 9.30 before 9.30.1874 (MR1); 9.20 before 9.20.2337 (MR3); 9.10 before 9.10.3194 (MR6); 9.00 before 9.00.3371 (MR7)
CVE-2025-48430	5.5	0%	Oct 23	Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will Affected: through 8.90; 9.30 before 9.30.2482 (MR2); 9.20 before 9.20.2819 (MR4); 9.10 before 9.10.3672 (MR7); 9.00 before 9.00.3831 (MR8)
CVE-2025-41402	5.5	0%	Oct 23	Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks Affected: through 9.00; 9.30 before 9.30.2482 (MR2); 9.20 before 9.20.2819 (MR4); 9.10 before 9.10.3672 (MR7)
CVE-2025-35981	5.5	0%	Oct 23	Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a… Affected: 9.30.1874 (MR1); 9.20.2337 (MR3); 9.10.3194 (MR6)
CVE-2024-21838	5.4	0%	Mar 5	Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails… Affected: through 8.60; 9.00 before vEL9.00.1774 (MR2); 8.90 before vEL8.90.1751 (MR3); 8.80 before vEL8.80.1526 (MR4); 8.70 before vEL8.70.2526
CVE-2026-26053	5.3	0%	Jul 7	An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that… Affected: 9.10; 9.50 before vEL9.50.1587(MR1); 9.40 before vEL9.40.3130(MR3); 9.30 before vEL9.30.3983(MR5); 9.20 before vEL9.20.4349(MR7)
CVE-2023-23584	4.3	1%	Dec 18	An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be… Affected: through 8.50; 8.70 before 8.70.1787 (MR2); 8.60 before 8.60.2039 (MR4)
CVE-2023-23576	4.3	0%	Dec 18	Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when… Affected: through 8.50; 8.90 before 8.90.1620 (MR2); 8.80 before 8.80.1369 (MR3); 8.70 before 8.70.2375 (MR5); 8.60 before 8.60.2550 (MR7)
CVE-2026-20757	2.5	0%	Mar 3	Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server Affected: through 9.00; 9.40 before 9.40.1976(MR1); 9.30 before 9.30.3382 (MR4); 9.20 before 9.20.3783 (MR6); 9.10 before 9.10.4647 (MR9)