This vulnerability (CVE-2026-25193) involves the insertion of sensitive Service Account credentials into log files generated by some Command Centre Service installers in Gallagher Command Centre Server version 9.40. The exposure risk applies only to installations using custom Service Accounts rather than the default Network Service account. The vulnerability is categorized under CWE-532 (Insertion of Sensitive Information into Log File). No official patch or remediation level has been provided by Gallagher. Mitigation involves changing the Service Account password and removing the installer log files to prevent credential compromise.

If exploited, this vulnerability could lead to unauthorized disclosure of Service Account credentials, potentially allowing attackers to gain elevated access or disrupt service integrity and availability. The impact includes confidentiality loss (credential exposure), integrity compromise, and availability disruption as indicated by the CVSS vector. However, exploitation requires local access to the log files and use of a custom Service Account, limiting the scope of affected environments.

No official patch or fix is currently available from Gallagher. The vendor recommends that affected sites change the Service Account password if they use a custom Service Account. Additionally, deleting any installer log files found in %programdata%\Gallagher\Command Centre can reduce the risk of credential exposure. Monitor vendor advisories for updates regarding official remediation.