Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-25193: Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lea

29
Routine
HIGH 8.1UPGRADEUPGRADEUPGRADE

CVE-2026-25193 is a high-severity flaw (CVSS 8.1) affecting active directory sync, cardholder sync utility, command centre. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also de

Why this priority

  • High severity

A fixed release or distro patch exists.

Risk facts

CVSS score8.1 (High)
Attack vectorLocal
Attack complexityLow
Privileges neededLow
User interactionRequired
EPSS exploit chance0.1% (top 97%)
CISA exploited listNo
WeaknessCWE-532
Published2026-05-25
Last modified2026-08-17
Publisher (CNA): Gallagher Group Ltd. · Vendor: gallagher

Share: LinkedIn · X · Reddit

Last updated 2026-08-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

gallagher active directory sync UPGRADE
Affected: < 9.10.05
Fixed in: 9.10.05
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy active-directory-sync || rpm -q active-directory-sync || active-directory-sync --version
2. UPGRADE to 9.10.05 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade active-directory-sync
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade active-directory-sync
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
gallagher cardholder sync utility UPGRADE
Affected: < 9.30.104
Fixed in: 9.30.104
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy cardholder-sync-utility || rpm -q cardholder-sync-utility || cardholder-sync-utility --version
2. UPGRADE to 9.30.104 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade cardholder-sync-utility
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade cardholder-sync-utility
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
gallagher command centre UPGRADE
Affected: < 9.40.2575
Fixed in: 9.40.2575
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy command-centre || rpm -q command-centre || command-centre --version
2. UPGRADE to 9.40.2575 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade command-centre
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade command-centre
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
gallagher diagnostics service UPGRADE
Affected: < 2.0.9
Fixed in: 2.0.9
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy diagnostics-service || rpm -q diagnostics-service || diagnostics-service --version
2. UPGRADE to 2.0.9 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade diagnostics-service
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade diagnostics-service
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
gallagher elevator service UPGRADE
Affected: < 10.0.8
Fixed in: 10.0.8
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy elevator-service || rpm -q elevator-service || elevator-service --version
2. UPGRADE to 10.0.8 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade elevator-service
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade elevator-service
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
gallagher encoding kiosk application UPGRADE
Affected: < 9.60.10
Fixed in: 9.60.10
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy encoding-kiosk-application || rpm -q encoding-kiosk-application || encoding-kiosk-application --version
2. UPGRADE to 9.60.10 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade encoding-kiosk-application
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade encoding-kiosk-application
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-25193?

active directory sync: upgrade to 9.10.05; cardholder sync utility: upgrade to 9.30.104; command centre: upgrade to 9.40.2575. Exact commands for each OS are on this page.

Is CVE-2026-25193 being exploited?

CVE-2026-25193 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-25193 affect?

CVE-2026-25193 affects active directory sync, cardholder sync utility, command centre. Severity is high (CVSS 8.1). Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Servi

How urgent is CVE-2026-25193?

Priority 29/100. High severity

Software pages

Active Directory vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.