Loading story…
Gladinet CentreStack versions before 17.3 contain an unauthenticated deserialization vulnerability in GSNamespace.dll that allows remote attackers to create arbitrary local operating system user accounts on exposed servers. The issue is tracked as CVE-2026-54365 and affects API endpoints including jsonimportuserbyupn, jsonimportuserbyupnex, and japiimportuserbyupn, where a crafted base64-encoded XML value supplied through the StorageConfigure parameter can reach InternalImportAdUserByUPN().
Successful exploitation causes GladinetCloudMonitor.exe to invoke the Windows NetUserAdd API with attacker-controlled credentials, enabling unauthorized account creation without prior authentication. The flaw can also be used to create arbitrary directories on the server filesystem, and it has been classified with CWE-306 and a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, reflecting a network-accessible vulnerability with low attack complexity and high integrity impact.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A vulnerability affecting Gladinet CentreStack before version 17.3 was disclosed. The unauthenticated deserialization flaw in GSNamespace.dll allows remote attackers to create arbitrary local OS user accounts via crafted base64-encoded XML sent to exposed API endpoints, and can also create arbitrary directories on the server filesystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gladinet CentreStack was disclosed with multiple high-severity vulnerabilities affecting versions prior to **17.5**, including an authentication bypass (`CVE-2026-54367`), a hardcoded-key token forgery issue (`CVE-2026-54363`), and a SQL injection flaw (`CVE-2026-54368`). The authentication bypass lets unauthenticated attackers forge encrypted `EntAcctId` values using a static shared key to read, modify, or delete arbitrary account settings, including cluster-wide configuration, while also enabling tenant-domain and administrator enumeration. The token forgery flaw stems from a static `SysNumber` value used in ticket encryption, allowing attackers to craft valid `x-glad-auth` headers and obtain privileged identity tokens from sensitive API endpoints.
Jul 31, 2026
Attackers are actively exploiting a critical cryptographic vulnerability in Gladinet's CentreStack and Triofox products, which are used for secure remote file access and sharing. The flaw stems from the use of hard-coded cryptographic keys within the `GladCtrl64.dll` component, allowing threat actors to decrypt or forge access tickets and gain unauthorized access to sensitive files, including `web.config`. This access can be leveraged to obtain machine keys and achieve remote code execution via ViewState deserialization. Security researchers from Huntress have observed at least nine organizations targeted by these attacks, with exploitation occurring in the wild and Gladinet issuing advisories and updates to mitigate the risk. The vulnerability is rooted in a custom implementation of the AES algorithm, where static 100-byte strings are used to derive encryption keys and initialization vectors, making them identical across all installations. Attackers can craft malicious requests to the `/storage/filesvr.dn` endpoint, bypassing authentication and impersonating users. Gladinet has provided indicators of compromise (IoCs) and urged customers to update to the latest versions released on November 29. The attacks highlight the risks of insecure cryptographic practices and the importance of timely patching in enterprise environments.
Jun 29, 2026
Attackers are actively exploiting a zero-day vulnerability, CVE-2025-11371, in Gladinet CentreStack and TrioFox file-sharing and remote access platforms. This vulnerability is an unauthenticated local file inclusion (LFI) flaw that allows threat actors to access sensitive system files, including the application’s Web.config file. By retrieving the machine key from this configuration file, attackers can leverage a previously patched vulnerability, CVE-2025-30406, to achieve remote code execution (RCE) through ViewState deserialization attacks. Huntress, a cybersecurity firm, first detected exploitation of this flaw on September 26-27, 2025, and has confirmed that at least three customers have been impacted so far. The vulnerability affects all versions of CentreStack and TrioFox up to and including 16.7.10368.56560, and there is currently no official patch available from Gladinet. Both self-hosted and cloud-hosted deployments of these platforms are at risk, as the flaw impacts default installations and configurations. The exploitation chain involves using the LFI to extract the machine key, which is then used to craft malicious ViewState payloads that bypass integrity checks and enable arbitrary code execution on the server. Notably, Huntress observed successful exploitation even on systems that had already patched CVE-2025-30406, indicating that the previous fix was insufficient to fully mitigate the risk. In response, Huntress and other security experts recommend disabling the "temp" handler within the UploadDownloadProxy Web.config file as an immediate mitigation, though this may impact some platform functionality. Gladinet has acknowledged the vulnerability and its active exploitation but has not yet released a patch, urging customers to implement the recommended mitigations. The affected products are widely used by managed service providers, small businesses, and enterprises for secure file access and sharing, increasing the potential impact of this vulnerability. Attackers exploiting this flaw can gain full control over affected servers, leading to data theft, lateral movement, or further compromise of organizational networks. Security researchers are withholding some technical details to prevent further exploitation while a patch is developed. Organizations using CentreStack or TrioFox should urgently review their configurations and apply the recommended mitigations to reduce exposure. The incident highlights the risks associated with chained vulnerabilities and the importance of defense-in-depth strategies. Ongoing monitoring and threat detection are advised until a permanent fix is available. The situation remains fluid, with active exploitation continuing and the vendor working on a security update.
Jun 29, 2026