← Back

CVE-2026-25193

nvd nist
Published: May 25, 2026Modified: Aug 17, 2026

JSON object

Loading...
8.6
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 6.0
Source: NVD

Description

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

Affected (15)

Gallagher
15 products
Active Directory Sync
Cardholder Sync Utility
Command Centre
Diagnostics Service
Elevator Service
Encoding Kiosk Application
Entra Id Sync V1
Entra Id Sync V2
Event Logger
Event Sync Utility
Middleware Framework
Nexudus Integration
Okta Sync
Papercut Interface Integration
Sip Integration
Configuration A
15 vulnerable
Vulnerable SoftwareAffected Versions
Active Directory Sync
Before 9.10.05
Cardholder Sync Utility
Before 9.30.104
Command Centre
Before 9.40.2575
Diagnostics Service
Before 2.0.9
Elevator Service
Before 10.0.8
Encoding Kiosk Application
Before 9.60.10
Entra Id Sync V1
Before 1.0.10
Entra Id Sync V2
Before 2.0.5
Event Logger
Before 8.90.16
Event Sync Utility
Before 8.70.62
Middleware Framework
Before 8.90.34
Nexudus Integration
Before 9.60.21
Okta Sync
Before 9.40.05
Papercut Interface Integration
Before 9.60.02
Sip Integration
Before 10.10

Related CWEs

CWE-532
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (1)

Source: disclosures@gallagher.com
Vendor Advisory

Timeline

No history available yet.