Pharos Controls Mosaic Show Controller

CISA published an advisory for CVE-2026-2417, a critical vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3. The vulnerability allows unauthenticated attackers to execute arbitrary commands with root privileges due to missing authentication for critical functions. The vulnerability has a CVSS score of 9.8 (Critical) and affects commercial facilities worldwide. Pharos Controls recommends upgrading to version 2.16 or later to mitigate the issue. The vulnerability was reported by James Tully to CISA. No known public exploitation has been reported at this time.