Description
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
Affected products
gallagher: active directory sync; gallagher: cardholder sync utility; gallagher: command centre; gallagher: diagnostics service; gallagher: elevator service; gallagher: encoding kiosk application; gallagher: entra id sync v1; gallagher: entra id sync v2; gallagher: event logger; gallagher: event sync utility; gallagher: middleware framework; gallagher: nexudus integration; gallagher: okta sync; gallagher: papercut interface integration; gallagher: sip integration
References1
- security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-25193 Vendor Advisory
Metrics
- CVSS 3.1
-
8.6
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 3 · as of 14 November 2026
- CWE
- CWE-532
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.