VulnerabilityAnalyzed

CVE-2026-25193

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.

HIGH 8.6EPSS 0.14%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

CVSS 3.1: 8.6 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS: 0.14% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-532
Affected: gallagher/active directory sync · gallagher/cardholder sync utility · gallagher/command centre · gallagher/diagnostics service · gallagher/elevator service · gallagher/encoding kiosk application · gallagher/entra id sync v1 · gallagher/entra id sync v2 · gallagher/event logger · gallagher/event sync utility · gallagher/middleware framework · gallagher/nexudus integration · gallagher/okta sync · gallagher/papercut interface integration · gallagher/sip integration
Source: disclosures@gallagher.com

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-25193Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.