Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentia

Summary

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

Timeline

1. May 25, 2026, 5:28 AM UTCCVE published
2. May 26, 2026, 2:24 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. May 26, 2026, 2:24 PM UTCRecord last updated

Affected versions

• Gallagher Command Centre Server

  From 9.40 · fixed in 9.40.2575 (MR2)

• Gallagher Active Directory Sync

  fixed in 9.10.05

• Gallagher Cardholder Sync Utility

  fixed in 9.30.104

• Gallagher Diagnostics Service

  fixed in 2.0.9

• Gallagher Elevator Service

  fixed in 10.0.8

• Gallagher Encoding Kiosk Application

  fixed in 9.60.10

• Gallagher Entra ID Sync

  From 1.0 · fixed in 1.0.10; From 2.0 · fixed in 2.0.5

• Gallagher Event Sync Utility

  fixed in 8.70.62

• Gallagher Event Logger

  fixed in 8.90.16

• Gallagher Middleware Framework

  fixed in 8.90.34

• Gallagher Nexudus Integration

  fixed in 9.60.21

• Gallagher Okta Sync

  fixed in 9.40.05

• Gallagher Papercut Interface Integration

  fixed in 9.60.02

• Gallagher SIP Integration

  fixed in 10.1.0

References 1