TI-2026-29351 Aliases CVE-2026-40619 GHSA-pc23-4mq4-c95v

Sensitive information in log files in Genetec Security Center

LOW 35CWE-532Published 2026-06-02 · Updated 2026-07-31

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of active exploitation. This vulnerability is associated with specific installation package builds rather than the product version identifier alone. Certain versions (including 5.10.4.0, 5.11.3.0, 5.12.2.0 and 5.13.3.0) were released with both vulnerable and remediated installation packages under the same version number. Consequently, version-based comparison alone is insufficient to determine exposure. Only installations performed using vulnerable builds are affected. Remediated builds can be distinguished using verified installation package hashes. For the complete list of fixed build hashes, refer to the security advisory section.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00115 1st percentileScored 2026-11-07

Fix Fixed Genetec Security Center (Genetec Inc.): >5.10.4.0, >5.11.3.0, >5.12.2.0 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Genetec Inc.	Genetec Security Center	>=5.7 SR6 <=5.10.4.0; >=5.11.0.0 <=5.11.3.0; >=5.12.0.0 <=5.12.2.0; >=5.13.0.0 <=5.13.3.0	>5.10.4.0, >5.11.3.0, >5.12.2.0, >5.13.3.0, >=5.14.0.0	Patch available	CNA

Genetec Security Center VendorGenetec Inc. Affected >=5.7 SR6 <=5.10.4.0; >=5.11.0.0 <=5.11.3.0; >=5.12.0.0 <=5.12.2.0; >=5.13.0.0 <=5.13.3.0 Fixed in >5.10.4.0, >5.11.3.0, >5.12.2.0, >5.13.3.0, >=5.14.0.0 Patch available CNA

Remediation

Fix · CNA Genetec Security Center (Genetec Inc.) Fixed in >5.10.4.0, >5.11.3.0, >5.12.2.0, >5.13.3.0, >=5.14.0.0

Timeline

2026-10-02 Threatist record created from CVE-2026-40619
2026-10-03 Alias added: GHSA-pc23-4mq4-c95v

References

Other 1

https://resources.genetec.com/security-advisories/vulnerability-affecting-security-center-systems-main-server-installations

TI-2025-27894 Improper access control in Genetec Security Center CVSS 3.1CRITICAL 9.8
TI-2024-06541 A high-severity vulnerability that can lead to arbitrary code execution on the system… CVSS 4.0HIGH 8.9
TI-2023-01436 SQL Injection in the Hardware Inventory report of Security Center 5.11.2. CVSS 3.1HIGH 8.8
TI-2026-40225 Improper authentication in Genetec Security Center CVSS 3.1HIGH 7.5
TI-2026-20275 A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack. CVSS 3.1HIGH 7.8
TI-2025-02559 SQL Injection affecting the Archiver role. CVSS 3.1HIGH 7.2

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences