PT-2026-56144 · Unknown · Controller 6000+1

Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-27844

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Controller 6000 and Controller 7000 versions prior to vCR9.50.260616a Controller 6000 and Controller 7000 versions prior to vCR9.40.260616a Controller 6000 and Controller 7000 versions prior to vCR9.30.260616a Controller 6000 and Controller 7000 versions prior to vCR9.20.260616a Controller 6000 and Controller 7000 versions 9.10 and prior

Description An uncaught exception in the diagnostic web interface allows an authenticated and authorized operator to trigger a controller restart by sending specific requests. This action results in a temporary denial of service, which is a condition where the system becomes unavailable to its intended users.

Recommendations Update to version vCR9.50.260616a or later. Update to version vCR9.40.260616a or later. Update to version vCR9.30.260616a or later. Update to version vCR9.20.260616a or later. Update to a version newer than 9.10.

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2026-27844

Affected Products

Controller 6000

Controller 7000

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-27844 · Security Note
• https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27844 · Note
• https://twitter.com/CVEnew/status/2074365809464315941 · Twitter Post