CVE-2026-25193

State: Published
Severity: 8.1 High
Published: May 25, 2026
Updated: May 26, 2026
Reserved: Mar 1, 2026

Description

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted.

Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H	Gallagher

Weaknesses

CWE-532 Insertion of sensitive information into log file

Affected Products

Product	Versions
Command Centre ServerGallagher	9.40 to before 9.40.2575 (MR2)Affected
Active Directory SyncGallagher	before 9.10.05Affected
Cardholder Sync UtilityGallagher	before 9.30.104Affected
Diagnostics ServiceGallagher	before 2.0.9Affected
Elevator ServiceGallagher	before 10.0.8Affected
Encoding Kiosk ApplicationGallagher	before 9.60.10Affected
Entra ID SyncGallagher	1.0 to before 1.0.10Affected 2.0 to before 2.0.5Affected
Event Sync UtilityGallagher	before 8.70.62Affected
Event LoggerGallagher	before 8.90.16Affected
Middleware FrameworkGallagher	before 8.90.34Affected
Nexudus IntegrationGallagher	before 9.60.21Affected
Okta SyncGallagher	before 9.40.05Affected
Papercut Interface IntegrationGallagher	before 9.60.02Affected
SIP IntegrationGallagher	before 10.1.0Affected

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-25193

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.