CVE-2026-25193 describes a CWE-532 vulnerability where certain Command Centre Service installers insert sensitive information, such as Service Account credentials, into log files. This exposure is limited to installations using a custom Service Account rather than the default Network Service account. The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity with local attack vector, low complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability. No patch or official fix is indicated in the provided data. The recommended mitigation is to change the Service Account password and delete any installer log files to prevent credential exposure.

Exposure of Service Account credentials through log files can lead to unauthorized access, potentially compromising confidentiality, integrity, and availability of the affected services. The impact is limited to environments using custom Service Accounts, reducing the overall attack surface. There are no known exploits in the wild at this time.

No official patch or fix is currently indicated. For sites concerned about exposure, it is recommended to change the Service Account password and delete any installer log files, typically found in %programdata%\Gallagher\Command Centre. This mitigates the risk of credential exposure from existing logs.