CVE-2026-26053
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform operations they would not normally be authorized to do. Affected versions: 9.50 prior to MR1, 9.40 prior to MR3, 9.30 prior to MR5, 9.20 prior to MR7, and all versions of 9.10.
Risk Assessment
The risk involves potential privilege escalation by an operator, leading to unauthorized access to sensitive system functions, potentially compromising data integrity and confidentiality.
Recommendation
Immediately update Command Centre Server to versions: 9.50 MR1, 9.40 MR3, 9.30 MR5, 9.20 MR7 or later. For version 9.10, migrate to a supported version.
Other vulnerabilities in Command Centre Server
See all- CVE-2026-20757Low
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. Affected versions: 9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), and all versions of 9.00 and prior.
- CVE-2025-48430Medium
Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
- CVE-2025-41402Medium
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.
- CVE-2025-35981Medium
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6).
Original NVD description (English source)
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS