What is the CVSS score of CVE-2026-25193?

CVE-2026-25193 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Gallagher Command Centre are affected by CVE-2026-25193?

Gallagher Command Centre installers expose service account credentials in locally-readable log files, creating a privilege escalation vector for any user with file system access.. A patch is available.

How to fix or mitigate CVE-2026-25193?

Within 24 hours: Inventory all Gallagher Command Centre deployments (Server, Active Directory Sync, Entra ID Sync, Elevator Service, Middleware Framework) with non-default service accounts; obtain patch version from vendor advisory. Within 7 days: Apply available patch to all affected components; rotate non-default service account credentials immediately; audit %programdata%\Gallagher\Command Centre directory for log files containing credentials and delete after secure rotation. Within 30 days: Enforce least-privilege NTFS permissions on Gallagher installation directories; implement file integrity monitoring on log locations; review audit logs for unauthorized local access.

Gallagher Command Centre CVE-2026-25193

EUVD-2026-31636 HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-05-25 Gallagher

GHSA-5p63-2cwc-2x43

Information Disclosure Command Centre Server Active Directory Sync Cardholder Sync Utility Diagnostics Service Elevator Service Encoding Kiosk Application Entra Id Sync Event Sync Utility Event Logger Middleware Framework Nexudus Integration Okta Sync Papercut Interface Integration Sip Integration Gallagher

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

6.3 MEDIUM

Credential disclosure has no direct integrity or availability impact; scope change justified by credentials enabling access to external identity systems.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 18:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 18:22 NVD

8.1 (HIGH) 8.6 (HIGH)

Analysis Generated

Jun 08, 2026 - 09:23 vuln.today

Patch available

May 26, 2026 - 14:16 EUVD

CVE Published

May 25, 2026 - 05:28 nvd

HIGH 8.1

DescriptionNVD

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted.

Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

AnalysisAI

Installer log files across 15 Gallagher Command Centre service components write Service Account credentials in plaintext to %programdata%\Gallagher\Command Centre during installation, enabling any local attacker with filesystem read access to harvest those credentials. Exploitation is gated by a non-default configuration - only deployments that replaced the default Network Service account with a custom Service Account are at risk - which substantially narrows the real-world attack surface. No public exploit code exists, EPSS sits at the 2nd percentile, and CISA SSVC classifies exploitation as 'none', but the downstream blast radius is significant: exposed credentials could authenticate an attacker into Active Directory, Entra ID, Okta, or physical-access control infrastructure.

Technical ContextAI

CWE-532 (Insertion of Sensitive Information into Log File) occurs when software writes security-sensitive data - here, Service Account username and password supplied during installation - to log output without sanitisation or masking. The affected codebase spans 15 discrete installer packages across the Gallagher Command Centre ecosystem (CPE prefix cpe:2.3:a:gallagher:*), including Command Centre Server, Active Directory Sync, Entra ID Sync, Elevator Service, Okta Sync, Middleware Framework, and SIP Integration. The Windows installer writes logs to %programdata%\Gallagher\Command Centre, a path that may be readable by local non-privileged users, meaning the credentials persist on disk after installation unless actively deleted. The scope change in the CVSS vector (S:C) reflects that the exposed credentials operate against external identity and physical-security systems beyond the local host.

RemediationAI

Gallagher has released patched versions for all affected components; upgrade to the fixed versions listed in the affected products section via the vendor advisory at https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-25193. As an immediate compensating control, change the Service Account password for any installation that used a custom account - this invalidates any credentials already captured from existing log files. Delete installer log files found at %programdata%\Gallagher\Command Centre to eliminate the credential artifact from disk; note that log deletion is a one-time remediation and does not prevent re-exposure during future reinstallations on unpatched versions. Sites that have not yet deployed a custom Service Account should retain the default Network Service account until patching is complete, as they are not affected. No workaround exists that preserves log functionality while preventing credential exposure on unpatched versions.