Skip to main content

Gladinet CentreStack CVE-2026-54363

| EUVDEUVD-2026-51099 CRITICAL
Use of Hard-coded Cryptographic Key (CWE-321)
2026-07-30 VulnCheck GHSA-vmg2-rwj3-8rq2
RCE Centrestack
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Unauthenticated network token forgery (PR:N/AV:N/AC:L) yields domain-admin RCE crossing the auth boundary, so Scope:Changed and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 30, 2026 - 14:03 EUVD
Analysis Generated
Jul 30, 2026 - 13:22 vuln.today
CVE Published
Jul 30, 2026 - 12:24 cve.org
CRITICAL 9.3

DescriptionCVE.org

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.

AnalysisAI

Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a static SysNumber used as entropy for AccessTicket.Encrypt/Decrypt across all installations), letting attackers forge valid x-glad-auth headers, invoke privileged endpoints like acquiretenantbackuptoken, and escalate to a domain administrator IdentityTicket for full server takeover. Reported by VulnCheck and carrying a CVSS 4.0 base of 9.3, it is remotely exploitable against default configurations with no authentication or user interaction. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach CentreStack API over network
Delivery
Forge encrypted AccessTicket with hardcoded key
Exploit
Send crafted x-glad-auth header
Execution
Call acquiretenantbackuptoken endpoint
Persist
Obtain domain-admin IdentityTicket
Impact
Execute code as privileged user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions - remote unauthenticated exploitation against default configurations of Gladinet CentreStack before 17.5, because the vulnerable static SysNumber entropy is present in all installations. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue rather than a paper-high score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who knows the hardcoded SysNumber key computes a valid encrypted AccessTicket offline, sets it as the x-glad-auth header, and calls a privileged endpoint such as acquiretenantbackuptoken on an internet-reachable CentreStack server. The server accepts the forged token, returns a domain-administrator IdentityTicket, and the attacker leverages that to execute code on the host - all without any credentials or user interaction, consistent with the AV:N/AC:L/PR:N/UI:N vector.
Remediation Upgrade to CentreStack 17.5 or later, which is the fixed release boundary indicated by the 'before 17.5' affected range (Vendor-released patch: 17.5); confirm the exact build against the VulnCheck advisory at https://www.vulncheck.com/advisories/centrestack-hardcoded-key-token-forgery-rce and the vendor at https://www.centrestack.com/ before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify and document all Gladinet CentreStack deployments and determine which versions are affected (any version before 17.5); immediately segment these systems from the network perimeter and restrict administrative access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Centrestack

View all
CVE-2025-30406 CRITICAL POC
9.0 Apr 03

Gladinet CentreStack contains a deserialization vulnerability caused by a hardcoded machineKey in the portal, allowing u
CVE-2023-26829 CRITICAL POC
9.8 Mar 31

An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows r
CVE-2023-26830 HIGH POC
7.2 Mar 31

An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before
CVE-2026-54367 HIGH
8.8 Jul 30

Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete

CVE-2026-54365 HIGH
8.7 Jul 30

Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure des
CVE-2026-54368 HIGH
8.7 Jul 30

SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbit
CVE-2026-54366 HIGH
8.7 Jul 30

Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary s
CVE-2026-54364 MEDIUM
6.9 Jul 30

Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass

Same weakness CWE-321 – Use of Hard-coded Cryptographic Key

View all
CVE-2016-4437 CRITICAL POC
9.8
CVE-2025-30406 CRITICAL POC
9.0
CVE-2023-32077 HIGH POC
7.5
CVE-2025-13316 HIGH POC
8.2
CVE-2020-10884 HIGH POC
8.8
CVE-2025-57174 CRITICAL POC
9.8
CVE-2022-0664 CRITICAL POC
9.8
CVE-2025-59407 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2026-54363 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy