CVE-2026-25193: Command Centre Service Log Vulnerability

CVE-2026-25193 Overview

CVE-2026-25193 is an information disclosure vulnerability affecting Gallagher Command Centre Service installers. The flaw stems from improper logging behavior, where the installer writes sensitive Service Account credentials into log files on disk. The issue is classified under Insertion of Sensitive Information into Log File [CWE-532].

Only deployments that configured Command Centre Services with a custom Service Account are affected. Sites using the default Network Service account are not impacted. An attacker with local access and low privileges can read the installer logs to recover credentials, enabling lateral movement within the access control environment.

Critical Impact
Local attackers with read access to %programdata%\Gallagher\Command Centre can extract custom Service Account credentials from installer log files, enabling privilege escalation and integrity compromise of the Command Centre Service.

Affected Products

Gallagher Command Centre Service installers (versions identified in the vendor advisory)
Deployments configured with a custom Service Account
Systems retaining installer log files in %programdata%\Gallagher\Command Centre

Discovery Timeline

2026-05-25 - CVE-2026-25193 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-25193

Vulnerability Analysis

The vulnerability resides in the installation routine for Gallagher Command Centre Services. During installation, when an administrator specifies a custom Service Account rather than accepting the default Network Service identity, the installer captures the supplied credentials and writes them to its log output. These logs persist on disk after installation completes.

Because the credentials are written in a recoverable form within installer log files, any local user with read access to the log directory can recover the Service Account password. The Service Account typically holds elevated rights to operate Command Centre system components, databases, and integrations.

The attack requires user interaction during installation and local access for exploitation, but the consequences extend beyond confidentiality. Recovered credentials allow an attacker to authenticate as the Service Account, change scope to other resources the account can reach, and tamper with the integrity or availability of the access control system.

Root Cause

The root cause is improper handling of secrets during installation logging. Credential values supplied through installer prompts are not redacted, masked, or excluded from the diagnostic log stream before being persisted to %programdata%\Gallagher\Command Centre.

Attack Vector

Exploitation requires local file system access to the host where the Command Centre Service was installed. An authenticated low-privilege user enumerates the installer log directory, reads the log files, and extracts the cleartext or recoverable credential material. The attacker then reuses the credentials to operate as the Service Account.

No verified exploit code is published. The vulnerability mechanism is described in the Gallagher Security Advisory CVE-2026-25193.

Detection Methods for CVE-2026-25193

Indicators of Compromise

Presence of installer log files under %programdata%\Gallagher\Command Centre containing Service Account name or password fields
Unexpected interactive or programmatic reads of the Gallagher installer log directory by non-administrative users
Authentication events from the Command Centre Service Account originating from unusual hosts or at unusual times

Detection Strategies

Audit file system access to %programdata%\Gallagher\Command Centre and alert on reads by accounts outside the installation administrator group
Search existing installer logs for keywords associated with credential prompts and flag any matches for remediation
Correlate Service Account logon events with installer host activity to identify credential reuse from unexpected sources

Monitoring Recommendations

Enable Windows object access auditing on the Gallagher installer log directory and forward events to a centralized log platform
Monitor for Service Account lateral movement, including SMB, WMI, and scheduled task creation attributed to the Command Centre Service identity
Track configuration changes to Command Centre Services that follow access to installer log files

How to Mitigate CVE-2026-25193

Immediate Actions Required

Rotate the password for any custom Service Account used to install Command Centre Services
Delete installer log files located in %programdata%\Gallagher\Command Centre on every affected host
Inventory hosts to identify which Command Centre installations used a custom Service Account versus the default Network Service
Review recent Service Account activity for signs of unauthorized use prior to remediation

Patch Information

Refer to the Gallagher Security Advisory CVE-2026-25193 for vendor-supplied installer versions and remediation guidance. The vendor's documented mitigation is to rotate the Service Account password and remove the installer log files.

Workarounds

Use the default Network Service account during Command Centre Service installation where operationally feasible
Restrict NTFS permissions on %programdata%\Gallagher\Command Centre so only administrators can read installer logs
Apply the principle of least privilege to any custom Service Account to limit blast radius if credentials are exposed

bash

# Configuration example: remove residual installer logs and restrict directory access
Remove-Item -Path "$env:ProgramData\Gallagher\Command Centre\*.log" -Force
icacls "$env:ProgramData\Gallagher\Command Centre" /inheritance:r
icacls "$env:ProgramData\Gallagher\Command Centre" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"