Skip to main content

Gladinet CentreStack CVE-2026-54365

| EUVDEUVD-2026-51101 HIGH
Missing Authentication for Critical Function (CWE-306)
2026-07-30 VulnCheck GHSA-q7f4-j8r5-hmxq
Microsoft Authentication Bypass Deserialization Centrestack
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable, low-complexity, unauthenticated (PR:N/UI:N) endpoint creates OS accounts giving high integrity impact; no direct confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 30, 2026 - 14:03 EUVD
Analysis Generated
Jul 30, 2026 - 13:22 vuln.today
CVE Published
Jul 30, 2026 - 12:25 cve.org
HIGH 8.7

DescriptionCVE.org

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacker-controlled credentials and create arbitrary directories on the server filesystem.

AnalysisAI

Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure deserialization path in GSNamespace.dll to add arbitrary local Windows accounts. By posting a crafted base64-encoded XML StorageConfigure value to the exposed jsonimportuserbyupn/jsonimportuserbyupnex/japiimportuserbyupn endpoints, an attacker (no credentials, per CVSS PR:N) drives InternalImportAdUserByUPN() to call NetUserAdd with attacker-chosen credentials and to create arbitrary server directories. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Reach exposed CentreStack API endpoint
Delivery
Send crafted base64 XML StorageConfigure payload
Exploit
Trigger deserialization in GSNamespace.dll
Install
Invoke InternalImportAdUserByUPN via monitor service
C2
Call NetUserAdd with attacker credentials
Execute
Create local OS account and directories
Impact
Persist for follow-on access
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network reachability to a CentreStack server (before 17.3) whose user-import API endpoints - jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn - are exposed and accepting requests; the attacker must supply a crafted base64-encoded XML StorageConfigure parameter that deserializes into InternalImportAdUserByUPN(). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N and VI:H, confirming a network-reachable, low-complexity, unauthenticated integrity attack with no required user interaction - a strong prioritization signal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker locates an Internet-exposed CentreStack server and sends an unauthenticated HTTP request to japiimportuserbyupn with a crafted base64-encoded XML StorageConfigure payload. The server deserializes it and invokes NetUserAdd, creating an attacker-controlled local OS account (and directories) on the host, which the attacker then uses as a foothold for persistence and lateral movement. …
Remediation Vendor-released patch: upgrade to CentreStack 17.3 or later, which remediates the unauthenticated deserialization path in GSNamespace.dll. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running Gladinet CentreStack versions prior to 17.3 and audit network exposure of these servers. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Centrestack

View all
CVE-2025-30406 CRITICAL POC
9.0 Apr 03

Gladinet CentreStack contains a deserialization vulnerability caused by a hardcoded machineKey in the portal, allowing u
CVE-2023-26829 CRITICAL POC
9.8 Mar 31

An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows r
CVE-2023-26830 HIGH POC
7.2 Mar 31

An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before
CVE-2026-54363 CRITICAL
9.3 Jul 30

Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a st
CVE-2026-54367 HIGH
8.8 Jul 30

Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete

CVE-2026-54368 HIGH
8.7 Jul 30

SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbit
CVE-2026-54366 HIGH
8.7 Jul 30

Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary s
CVE-2026-54364 MEDIUM
6.9 Jul 30

Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-54365 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy