Gallagher Command Centre EUVD-2026-31636

Exploitation requires three concurrent conditions: (1) a Gallagher Command Centre service component was installed using a custom Service Account instead of the default Network Service account - sites using the default account are explicitly not affected; (2) the installer log files at %programdata%\Gallagher\Command Centre have not been deleted post-installation; and (3) the attacker has local read access to that filesystem path. The CVSS UI:R metric indicates the installer must have been executed, meaning the credential-bearing log only exists if the product was actively installed. What limits exploitation: the non-default configuration requirement eliminates the majority of deployments; local access to the target host is mandatory (AV:L); and the credentials are static - rotating the Service Account password immediately neutralises any already-captured log content.

The official CVSS base score of 8.6 is driven primarily by the S:C (scope change) and H/H/H impact ratings, which reflect downstream misuse of the exposed credentials rather than the direct disclosure act itself - this is an atypical but defensible scoring choice for credential-exposure vulnerabilities. In practice, real-world risk is substantially lower than the score implies: SSVC classifies exploitation as 'none', EPSS is 0.01% (2nd percentile), no KEV listing, and no POC exists. The critical mitigating factor - that only sites using a custom Service Account are affected - eliminates all default-configured deployments. The CVSS vector specifies UI:R, meaning the installer must be actively run for the log to be written, and AV:L, confirming the attacker requires local filesystem access to the target machine. The high I:H and A:H official ratings require scrutiny: a credential-disclosure vulnerability does not itself modify or destroy data; those ratings appear to model attacker capability after credential reuse, not the direct impact of the CWE-532 flaw. Defenders should treat this as a credential hygiene and log-hygiene issue for a specific subset of deployments rather than a broadly critical remote threat.

A local user or attacker with filesystem read access on a Windows host where a Gallagher service was installed using a custom Service Account browses to %programdata%\Gallagher\Command Centre and opens an installer log file to extract the plaintext Service Account credentials. The attacker then uses those credentials to authenticate against Active Directory, Entra ID, or Okta - depending on which sync services were configured - potentially gaining access to identity infrastructure or physical-access control systems. No exploit code is required; the attack is entirely manual and requires only a text editor.