Information disclosure in Gallagher Active Directory Sync
CVE-2026-25193
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Serv…
EPSS: 0.000 (2.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H.
Affected products
- Gallagher Active Directory Sync — versions 0
- Gallagher Cardholder Sync Utility — versions 0
- Gallagher Command Centre Server — versions 9.40
- Gallagher Diagnostics Service — versions 0
- Gallagher Elevator Service — versions 0
- Gallagher Encoding Kiosk Application — versions 0
- Gallagher Entra Id Sync — versions 1.0, 2.0
- Gallagher Event Logger — versions 0
- Gallagher Event Sync Utility — versions 0
- Gallagher Middleware Framework — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-25193?
- CVE-2026-25193 is a high-severity vulnerability in Gallagher Active Directory Sync, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.1/10. Published 2026-05-25.
- How severe is CVE-2026-25193?
- High severity. CVSS v3 base score is 8.1 out of 10.