Which versions of Gladinet CentreStack are affected by CVE-2026-54366?

Gladinet CentreStack allows unauthenticated users to extract sensitive files including database credentials and encryption keys from production servers.. A patch is available.

How to fix or mitigate CVE-2026-54366?

Within 24 hours: Identify all Gladinet CentreStack deployments and their current versions, then restrict network access to the SharePoint StorageConfig handler to trusted internal sources only. Within 7 days: Deploy a Web Application Firewall (WAF) rule to detect and block XXE payloads (requests containing DOCTYPE or ENTITY declarations), and implement monitoring for unusual file access patterns in server logs. Within 30 days: Prioritize immediate upgrade to Gladinet CentreStack 17.4 or later once released, rotate all database credentials and cryptographic material that may have been exposed, and conduct a forensic audit of server logs to identify any unauthorized file access during the vulnerability window.

Gladinet CentreStack CVE-2026-54366

Q: What is the CVSS score of CVE-2026-54366?

CVE-2026-54366 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51102 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-07-30 VulnCheck

GHSA-m68w-g32j-mw5x

XXE Microsoft Centrestack Gladinet

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network XXE with low complexity and no interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality from arbitrary file read, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:22 vuln.today

CVE Published

Jul 30, 2026 - 12:25 cve.org

HIGH 8.7

DescriptionCVE.org

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.

AnalysisAI

Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary server files by abusing an XML External Entity (XXE) flaw in the SharePoint StorageConfig handler. By pointing the storage configuration at a malicious URL, an attacker forces the server to parse attacker-controlled XML with external DTD references and leak sensitive files such as Web.config, exposing database credentials and cryptographic key material. Reported by VulnCheck; no public exploit identified at time of analysis, and the CVSS 4.0 base score is 8.7 (High).

Technical ContextAI

The vulnerability is a classic CWE-611 (Improper Restriction of XML External Entity Reference) issue in the CentreStack file-sync/share platform's SharePoint storage integration. When the unauthenticated StorageConfig endpoint receives a supplied URL, the underlying .NET XML parser resolves external DTD/entity references embedded in the fetched document instead of disabling them. Because the affected component (cpe:2.3:a:gladinet:centrestack) runs as an IIS/.NET web application, the parser executes in the context of the web service and can read local files like Web.config, which in ASP.NET typically stores connection strings, machineKey values, and other secrets. The out-of-band variant uses external DTDs to smuggle file contents to an attacker-controlled server, bypassing the need for the response to echo parsed data.

RemediationAI

Upgrade to Gladinet CentreStack 17.4 or later, which is the vendor-fixed version resolving this XXE flaw; treat this as the primary remediation. Because exploitation targets the unauthenticated SharePoint StorageConfig endpoint, defenders who cannot immediately patch should restrict network access to the CentreStack management/StorageConfig endpoints (for example via WAF rules or IP allow-listing) and block outbound connections from the server to untrusted hosts to break the out-of-band DTD exfiltration channel - with the trade-off that legitimate external SharePoint/storage integrations may stop functioning. Given that Web.config secrets may already be exposed, rotate database credentials and the ASP.NET machineKey after patching. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/centrestack-xxe-via-sharepoint-storage-configuration for detection and version details.