CVE-2026-25193
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.
Published May 25, 2026 · updated Aug 17, 2026 · gallagher active directory sync
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 25, 2026 · NIST NVD
Detected
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to chang
Aug 17, 2026 · NIST NVD
Updated
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to chang
Affected
- cpe gallagher/active directory syncversion unspecified
- cpe gallagher/cardholder sync utilityversion unspecified
- cpe gallagher/command centreversion unspecified
- cpe gallagher/diagnostics serviceversion unspecified
- cpe gallagher/elevator serviceversion unspecified
- cpe gallagher/encoding kiosk applicationversion unspecified
- cpe gallagher/entra id sync v1version unspecified
- cpe gallagher/entra id sync v2version unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-25193
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-25193
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Serv
nvd.nist.gov