Information disclosure in Gallagher Active Directory Sync
CVE-2026-25193
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H.
EPSS exploit prediction
EPSS: 0.001 (2.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 2.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000
Affected products
- Gallagher Active Directory Sync — versions 0
- Gallagher Active Directory Sync
- Gallagher Cardholder Sync Utility — versions 0
- Gallagher Cardholder Sync Utility
- Gallagher Command Centre
- Gallagher Command Centre Server — versions 9.40
- Gallagher Diagnostics Service — versions 0
- Gallagher Diagnostics Service
- Gallagher Elevator Service — versions 0
- Gallagher Elevator Service
Weakness classification (CWE)
References
- security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-25193 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-25193?
- CVE-2026-25193 is a high-severity vulnerability in Gallagher Active Directory Sync, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.1/10. Published 2026-05-25.
- How severe is CVE-2026-25193?
- High severity. CVSS v3 base score is 8.1 out of 10.