CVE-2025-35981
Medium
Description
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6).
SeverityMedium
CVSS5.5
Exploit probability—
ProductCommand Centre Server
PublishedOct 23, 2025
First seenOct 23, 2025
Weakness typeCWE-359CWE-359
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Gallagher Command Centre Server | 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6) | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.