CVE-2026-40619: Security Center Information Disclosure Bug

CVE-2026-40619 Overview

CVE-2026-40619 affects Genetec Security Center main server installations. The vulnerability allows an attacker with local operating system privileges on the main server to access Server Admin credentials. A third party engaged by Genetec discovered the issue, and there is no current evidence of active exploitation.

The flaw is tied to specific installation package builds rather than version numbers alone. Versions 5.10.4.0, 5.11.3.0, 5.12.2.0, and 5.13.3.0 shipped with both vulnerable and remediated installation packages under identical version identifiers. Defenders must verify installation package hashes to confirm exposure.

Critical Impact

A local authenticated attacker can recover Server Admin credentials, leading to full compromise of confidentiality, integrity, and availability of the Security Center deployment.

Affected Products

• Genetec Security Center main server installations built from vulnerable installation packages
• Specific affected builds include releases tagged 5.10.4.0, 5.11.3.0, 5.12.2.0, and 5.13.3.0
• Only installations performed using vulnerable build hashes are exposed

Discovery Timeline

• 2026-06-02 - CVE-2026-40619 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-40619

Vulnerability Analysis

The weakness is categorized as Insertion of Sensitive Information into Log File [CWE-532]. Server Admin credentials are exposed in a location accessible to any local account on the main server. An attacker who has already authenticated to the underlying operating system can retrieve these credentials and escalate to administrative control of the Security Center platform.

The Server Admin role governs configuration of the Security Center directory, including user accounts, role assignments, and federation links. Credential exposure at this level grants the attacker full administrative control over surveillance, access control, and identity components managed by the deployment.

Because vulnerable and patched builds share version numbers, version-based asset inventories will misrepresent exposure. Identifying affected hosts requires comparing the installer hash on disk against the verified hashes published in the Genetec advisory.

Root Cause

The root cause is the storage of sensitive Server Admin credentials in a file or log that does not enforce least-privilege access controls. Local users without administrative rights can read the credential material. Remediated installation packages correct the storage location or apply restricted permissions to the affected artifact.

Attack Vector

Exploitation requires local access with low privileges on the main server. The attacker reads the credential artifact created during installation and reuses the recovered Server Admin credentials to authenticate against the Security Center directory. No user interaction is required.

The vulnerability mechanism is described in the Genetec Security Advisory. No public proof-of-concept code is available.

Detection Methods for CVE-2026-40619

Indicators of Compromise

• Unexpected reads of installation artifacts or log files in the Genetec Security Center installation directory by non-administrative local accounts
• Authentication events for the Server Admin account originating from unusual hosts, sessions, or times of day
• Configuration changes in Security Center directory settings, role assignments, or federation links without a corresponding change ticket

Detection Strategies

• Compute the SHA-256 hash of installer artifacts on each main server and compare against the verified remediated hashes listed in the Genetec advisory
• Enable file access auditing on the Security Center installation directory and alert on read access by accounts other than the Security Center service account or administrators
• Correlate local logon events on the main server with subsequent Server Admin authentications to detect credential reuse from low-privileged sessions

Monitoring Recommendations

• Forward Windows Security and Sysmon logs from main server hosts to a centralized SIEM for retention and behavioral analysis
• Baseline normal access patterns for the Security Center service account and alert on deviations such as new parent processes or off-hours access
• Monitor for privilege escalation attempts and lateral movement originating from the main server following any suspicious credential access

How to Mitigate CVE-2026-40619

Immediate Actions Required

• Verify the installation package hash on every Security Center main server against the remediated hash list in the Genetec advisory
• Reinstall affected main servers using a remediated installation package, then rotate the Server Admin credentials
• Restrict interactive and remote logon rights on main server hosts to a minimal set of administrators
• Audit all Server Admin authentication events and configuration changes since the affected installation date

Patch Information

Genetec has released remediated installation packages distinguished by verified build hashes rather than version numbers. Refer to the Genetec Security Advisory for the complete list of fixed installation package hashes. Apply a remediated build and rotate Server Admin credentials after reinstallation.

Workarounds

• Limit local access to the main server to a strictly enforced administrative group while planning reinstallation
• Apply restrictive file system access control lists on the Security Center installation directory to block read access by non-administrative local accounts
• Rotate Server Admin credentials and review directory role assignments to remove any unauthorized accounts

# Verify installer hash against the remediated value from the Genetec advisory
Get-FileHash -Algorithm SHA256 "C:\Path\To\GenetecSecurityCenterInstaller.exe"

# Restrict read access on the Security Center installation directory
icacls "C:\Program Files (x86)\Genetec Security Center" /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"