CVE-2026-25193

Description

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

Traduire en français

Produits concernés

• Gallagher Command Centre Server
• Gallagher Active Directory Sync
• Gallagher Cardholder Sync Utility
• Gallagher Diagnostics Service
• Gallagher Elevator Service
• Gallagher Encoding Kiosk Application
• Gallagher Entra ID Sync
• Gallagher Event Sync Utility
• Gallagher Event Logger
• Gallagher Middleware Framework
• Gallagher Nexudus Integration
• Gallagher Okta Sync
• Gallagher Papercut Interface Integration
• Gallagher SIP Integration
• Gallagher command centre
• Gallagher entra id sync v1
• Gallagher entra id sync v2

Scores CVSS

Faiblesses (CWE)

• CWE-532

Références

• https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-25193 Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories