What is the CVSS score of CVE-2026-8359?

CVE-2026-8359 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Triofox are affected by CVE-2026-8359?

Gladinet Triofox contains a remotely exploitable denial-of-service vulnerability (CVE-2026-8359) that allows unauthenticated attackers to crash the web service, creating unplanned downtime risk for…. A patch is available.

How to fix or mitigate CVE-2026-8359?

Within 24 hours: Deploy WAF or reverse proxy rules to block all HTTP requests with URL paths beginning with /status or /sysinfo to prevent exploitation. Within 7 days: Complete inventory of all Gladinet Triofox installations; restrict network access to the web service to authorized internal subnets only; enable enhanced monitoring of web service logs for exploitation attempts. Within 30 days: Contact Gladinet directly for patch availability and timeline; subscribe to Tenable advisories (TRA-2026-45) and CISA KEV for patch announcements; develop upgrade plan tied to patch release.

Triofox CVE-2026-8359

EUVD-2026-32646 HIGH

NULL Pointer Dereference (CWE-476)

2026-05-27 tenable

GHSA-f7wq-cj78-r6c9

Denial Of Service Null Pointer Dereference Triofox

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

May 27, 2026 - 22:04 EUVD

Analysis Generated

May 27, 2026 - 20:53 vuln.today

DescriptionCVE.org

When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_LoadHttpModule function in the dll would be called to set up a "module" object for that module. However, WOSHttpStatusModule.dll is not present in the installation. As a result, a function pointer to WOSBin_LoadHttpModule (which would have been in the export table in WOSHttpStatusModule.dll) is set to NULL, resulting in calling a function at address 0.

AnalysisAI

Denial of service in Gladinet Triofox lets unauthenticated remote attackers crash the web service by sending an HTTP request whose URL path begins with /status or /sysinfo. The server tries to load WOSHttpStatusModule.dll to service those paths and calls WOSBin_LoadHttpModule, but that DLL ships missing from the installation, so the resolved function pointer is NULL and the code invokes a function at address 0, terminating the process (CWE-476). The flaw was discovered and reported by Tenable (TRA-2026-45); no public exploit identified at time of analysis and it is not on the CISA KEV list, with availability-only impact (CVSS 7.5).