Loading story…
Gladinet CentreStack was disclosed with multiple high-severity vulnerabilities affecting versions prior to 17.5, including an authentication bypass (CVE-2026-54367), a hardcoded-key token forgery issue (CVE-2026-54363), and a SQL injection flaw (CVE-2026-54368). The authentication bypass lets unauthenticated attackers forge encrypted EntAcctId values using a static shared key to read, modify, or delete arbitrary account settings, including cluster-wide configuration, while also enabling tenant-domain and administrator enumeration. The token forgery flaw stems from a static SysNumber value used in ticket encryption, allowing attackers to craft valid x-glad-auth headers and obtain privileged identity tokens from sensitive API endpoints.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
ThreatAft reported a four-CVE CentreStack vulnerability bundle comprising CVE-2026-54363, CVE-2026-54365, CVE-2026-54367, and CVE-2026-54368. The report said patched releases were available, recommended upgrading to CentreStack 17.5 or later, and noted no active exploitation had been confirmed at publication.
The Canadian Centre for Cyber Security published advisory AV26-765 stating that Gladinet CentreStack is affected by vulnerabilities. The notice urged users and administrators to review Gladinet's guidance and apply updates as they become available.
A SQL injection vulnerability affecting Gladinet CentreStack before version 17.4 was disclosed as CVE-2026-54368. Through a crafted x-glad-filter header to the jsondir API endpoint, an authenticated attacker can execute arbitrary SQL and potentially write files to the server, leading to remote code execution.
CVE-2026-54367 was disclosed as an unauthenticated authorization bypass in Gladinet CentreStack before version 17.2. The issue lets attackers forge EntAcctId values using a static shared key to read, write, or delete arbitrary account settings and enumerate tenants and administrators.
A hardcoded cryptographic key vulnerability in Gladinet CentreStack before version 17.5 was disclosed as CVE-2026-54363. The flaw allows unauthenticated token forgery via a static SysNumber value and can enable a remote code execution chain through privileged API access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gladinet **CentreStack** versions before **17.3** contain an unauthenticated deserialization vulnerability in `GSNamespace.dll` that allows remote attackers to create arbitrary local operating system user accounts on exposed servers. The issue is tracked as **`CVE-2026-54365`** and affects API endpoints including `jsonimportuserbyupn`, `jsonimportuserbyupnex`, and `japiimportuserbyupn`, where a crafted base64-encoded XML value supplied through the `StorageConfigure` parameter can reach `InternalImportAdUserByUPN()`. Successful exploitation causes `GladinetCloudMonitor.exe` to invoke the Windows `NetUserAdd` API with attacker-controlled credentials, enabling unauthorized account creation without prior authentication. The flaw can also be used to create arbitrary directories on the server filesystem, and it has been classified with **CWE-306** and a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`, reflecting a network-accessible vulnerability with low attack complexity and high integrity impact.
Jul 30, 2026
Attackers are actively exploiting a critical cryptographic vulnerability in Gladinet's CentreStack and Triofox products, which are used for secure remote file access and sharing. The flaw stems from the use of hard-coded cryptographic keys within the `GladCtrl64.dll` component, allowing threat actors to decrypt or forge access tickets and gain unauthorized access to sensitive files, including `web.config`. This access can be leveraged to obtain machine keys and achieve remote code execution via ViewState deserialization. Security researchers from Huntress have observed at least nine organizations targeted by these attacks, with exploitation occurring in the wild and Gladinet issuing advisories and updates to mitigate the risk. The vulnerability is rooted in a custom implementation of the AES algorithm, where static 100-byte strings are used to derive encryption keys and initialization vectors, making them identical across all installations. Attackers can craft malicious requests to the `/storage/filesvr.dn` endpoint, bypassing authentication and impersonating users. Gladinet has provided indicators of compromise (IoCs) and urged customers to update to the latest versions released on November 29. The attacks highlight the risks of insecure cryptographic practices and the importance of timely patching in enterprise environments.
Jun 29, 2026
Attackers are actively exploiting a zero-day vulnerability, CVE-2025-11371, in Gladinet CentreStack and TrioFox file-sharing and remote access platforms. This vulnerability is an unauthenticated local file inclusion (LFI) flaw that allows threat actors to access sensitive system files, including the application’s Web.config file. By retrieving the machine key from this configuration file, attackers can leverage a previously patched vulnerability, CVE-2025-30406, to achieve remote code execution (RCE) through ViewState deserialization attacks. Huntress, a cybersecurity firm, first detected exploitation of this flaw on September 26-27, 2025, and has confirmed that at least three customers have been impacted so far. The vulnerability affects all versions of CentreStack and TrioFox up to and including 16.7.10368.56560, and there is currently no official patch available from Gladinet. Both self-hosted and cloud-hosted deployments of these platforms are at risk, as the flaw impacts default installations and configurations. The exploitation chain involves using the LFI to extract the machine key, which is then used to craft malicious ViewState payloads that bypass integrity checks and enable arbitrary code execution on the server. Notably, Huntress observed successful exploitation even on systems that had already patched CVE-2025-30406, indicating that the previous fix was insufficient to fully mitigate the risk. In response, Huntress and other security experts recommend disabling the "temp" handler within the UploadDownloadProxy Web.config file as an immediate mitigation, though this may impact some platform functionality. Gladinet has acknowledged the vulnerability and its active exploitation but has not yet released a patch, urging customers to implement the recommended mitigations. The affected products are widely used by managed service providers, small businesses, and enterprises for secure file access and sharing, increasing the potential impact of this vulnerability. Attackers exploiting this flaw can gain full control over affected servers, leading to data theft, lateral movement, or further compromise of organizational networks. Security researchers are withholding some technical details to prevent further exploitation while a patch is developed. Organizations using CentreStack or TrioFox should urgently review their configurations and apply the recommended mitigations to reduce exposure. The incident highlights the risks associated with chained vulnerabilities and the importance of defense-in-depth strategies. Ongoing monitoring and threat detection are advised until a permanent fix is available. The situation remains fluid, with active exploitation continuing and the vendor working on a security update.
Jun 29, 2026