CVE-2026-20757CWE-667

CVE-2026-20757

Low · published March 3, 2026

CVSS v3.1
2.5
EPSS
0%
Percentile
0.0
In the wild
Unconfirmed
What it is

Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server.

This issue affects Command Centre Server:

9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), all versions of 9.00 and prior.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00071 · 0.0th percentile
Weakness
CWE-667 · Improper Locking
Published
2026-03-03T08:15Z
Affected products (4)
ProductVersionsFixed in
gallagher/command_centre< 9.10.46479.10.4647
gallagher/command_centre≥ 9.20.1043, < 9.20.37839.20.3783
gallagher/command_centre≥ 9.30.1594, < 9.30.33829.30.3382
gallagher/command_centre≥ 9.40.1359, < 9.40.19769.40.1976
References (1)
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-20757 · [email protected]
EPSS history
Timeline
  • 03 MAR 02:40Z
    Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command…
    cvelistv5