Vulnerability · Published May 25, 2026 · Assigned by Gallagher
CVE-2026-25193
High 8.1
In plain English
A high-severity sensitive data in logs in Active Directory Sync from Gallagher. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gallagher | Command Centre Server | 9.40 – before 9.40.2575 (MR2) |
| Gallagher | Active Directory Sync | 0 – before 9.10.05 |
| Gallagher | Cardholder Sync Utility | 0 – before 9.30.104 |
| Gallagher | Diagnostics Service | 0 – before 2.0.9 |
| Gallagher | Elevator Service | 0 – before 10.0.8 |
| Gallagher | Encoding Kiosk Application | 0 – before 9.60.10 |
| Gallagher | Entra ID Sync | 1.0 – before 1.0.102.0 – before 2.0.5 |
| Gallagher | Event Sync Utility | 0 – before 8.70.62 |
| Gallagher | Event Logger | 0 – before 8.90.16 |
| Gallagher | Middleware Framework | 0 – before 8.90.34 |
| Gallagher | Nexudus Integration | 0 – before 9.60.21 |
| Gallagher | Okta Sync | 0 – before 9.40.05 |
| Gallagher | Papercut Interface Integration | 0 – before 9.60.02 |
| Gallagher | SIP Integration | 0 – before 10.1.0 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H