PT-2026-43004 · Gallagher · Command Centre Server

Published 2026-05-25 · Updated 2026-05-25 · CVE-2026-25193

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Command Centre Service (affected versions not specified)

Description Some installers for Command Centre Service improperly insert sensitive information into log files, which could lead to the exposure of Service Account credentials. This issue specifically impacts sites that install the services using a custom Service Account rather than the default Network Service account.

Recommendations Change the Service Account password. Delete installer log files, typically located in %programdata%GallagherCommand Centre.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-25193

Affected Products

Command Centre Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-25193 · Security Note
• https://twitter.com/CVEnew/status/2058935285879119874 · Twitter Post
• https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-25193 · Note
• https://twitter.com/infoflowcloud/status/2058936288095375663 · Twitter Post