ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2026-25193

—
CVSS 3.1
8.6 high
EPSS
<1%p3
Published
()
Modified
Description

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

Vendors
gallagher
Products
active directory sync, cardholder sync utility, command centre, diagnostics service, elevator service, encoding kiosk application, entra id sync v1, entra id sync v2, event logger, event sync utility, middleware framework, nexudus integration
Weakness
CWE-532
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (0.1%)

In the news

No ingested article mentions this CVE yet.