CVE-2026-40619: High severity Genetec Security Center Main Server vulnerability
A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of active exploitation.
This vulnerability is associated with specific installation package builds rather than the product version identifier alone. Certain versions (including 5.10.4.0, 5.11.3.0, 5.12.2.0 and 5.13.3.0) were released with both vulnerable and remediated installation packages under the same version number.
Consequently, version-based comparison alone is insufficient to determine exposure. Only installations performed using vulnerable builds are affected. Remediated builds can be distinguished using verified installation package hashes. For the complete list of fixed build hashes, refer to the security advisory section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.10.4.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.11.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.12.2.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.13.3.0 - Configuration
For affected versions where both vulnerable and remediated packages were released under the same version number, verify installation package integrity against the confirmed remediated build hashes from the security advisory. If the package hash does not match a known remediated value, consider the installation vulnerable.
Genetec Security Center main server installations Installation package integrity (hash verification) = Match against remediated build hashes - Operational
If you previously installed using a vulnerable build, plan to reinstall/replace with the updated remediated installation package build (the vulnerability allows local OS–privileged attackers to access Server Admin credentials).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40619?
CVE-2026-40619 has a high severity rating of 7.8.
What does CVE-2026-40619 entail?
CVE-2026-40619 is a vulnerability that allows an attacker with local OS privileges to access the Server Admin credentials on the Security Center main server.
How do I fix CVE-2026-40619?
To fix CVE-2026-40619, install the updated installation packages that have been released for affected versions of Security Center.
Who identified CVE-2026-40619?
CVE-2026-40619 was identified by a third party hired by Genetec.
Is there evidence of exploitation for CVE-2026-40619?
Currently, there is no evidence of active exploitation for CVE-2026-40619.