Which versions of Gladinet CentreStack are affected by CVE-2026-54363?

Gladinet CentreStack versions before 17.5 contain a critical vulnerability allowing unauthenticated attackers to gain domain administrator access and completely compromise affected server…. A patch is available.

How to fix or mitigate CVE-2026-54363?

Within 24 hours, identify and document all Gladinet CentreStack deployments and determine which versions are affected (any version before 17.5); immediately segment these systems from the network perimeter and restrict administrative access. Within 7 days, implement network-based mitigations such as Web Application Firewall (WAF) rules to detect and block forged authentication headers, enable enhanced logging to capture access attempts, and configure alerts for unusual admin activity. Within 30 days, monitor official Gladinet advisories and vendor communications for patch availability and test the upgrade to version 17.5 or later in a non-production environment; schedule production upgrades for immediate deployment upon patch validation.

Gladinet CentreStack CVE-2026-54363

Q: What is the CVSS score of CVE-2026-54363?

CVE-2026-54363 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-51099 CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2026-07-30 VulnCheck

GHSA-vmg2-rwj3-8rq2

RCE Centrestack Gladinet

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network token forgery (PR:N/AV:N/AC:L) yields domain-admin RCE crossing the auth boundary, so Scope:Changed and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:22 vuln.today

CVE Published

Jul 30, 2026 - 12:24 cve.org

CRITICAL 9.3

DescriptionCVE.org

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.

AnalysisAI

Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a static SysNumber used as entropy for AccessTicket.Encrypt/Decrypt across all installations), letting attackers forge valid x-glad-auth headers, invoke privileged endpoints like acquiretenantbackuptoken, and escalate to a domain administrator IdentityTicket for full server takeover. Reported by VulnCheck and carrying a CVSS 4.0 base of 9.3, it is remotely exploitable against default configurations with no authentication or user interaction. No public exploit code or CISA KEV listing is confirmed in the provided data, so at time of analysis there is no public exploit identified.

Technical ContextAI

CentreStack is a Gladinet file-sync-and-share and remote-access platform (cpe:2.3:a:gladinet:centrestack) commonly deployed as a self-hosted enterprise gateway over IIS/.NET. The root cause is CWE-321 (Use of a Hard-coded Cryptographic Key): the AccessTicket subsystem derives its encryption/decryption entropy from a static SysNumber value that is identical across every installation. Because the same key protects and validates authentication tickets everywhere, knowledge of that single embedded secret lets an attacker deterministically produce ciphertext the server will accept as authentic - collapsing the entire token-based trust model and permitting forgery of the x-glad-auth header used to authorize API calls.

RemediationAI

Upgrade to CentreStack 17.5 or later, which is the fixed release boundary indicated by the 'before 17.5' affected range (Vendor-released patch: 17.5); confirm the exact build against the VulnCheck advisory at https://www.vulncheck.com/advisories/centrestack-hardcoded-key-token-forgery-rce and the vendor at https://www.centrestack.com/ before deploying. Until patched, restrict network exposure of the CentreStack management and API surface - place it behind a VPN or IP allowlist and block untrusted access to the privileged endpoints (for example acquiretenantbackuptoken) at a reverse proxy or WAF, accepting that this may break legitimate remote-client or tenant-backup functionality. Because the root cause is a shared static key rather than a configuration option, there is no reliable in-product toggle to disable it, so network isolation and prompt upgrade are the effective controls; monitor for anomalous x-glad-auth usage and unexpected IdentityTicket issuance as a detective measure.