Which versions of Gladinet CentreStack are affected by EUVD-2026-51101?

Gladinet CentreStack before version 17.3 allows unauthenticated remote attackers to create arbitrary Windows OS accounts on affected servers, establishing persistent backdoor access without any…. A patch is available.

How to fix or mitigate EUVD-2026-51101?

Within 24 hours, identify all systems running Gladinet CentreStack versions prior to 17.3 and audit network exposure of these servers. Within 7 days, upgrade to CentreStack version 17.3 or later if available, or implement network segmentation to restrict untrusted access to the vulnerable jsonimportuserbyupn endpoints until patching is complete. Within 30 days, validate all CentreStack systems are running version 17.3 or newer, conduct a full audit of local Windows accounts to identify unauthorized access, and establish quarterly patch-management cycles for all CentreStack deployments.

Gladinet CentreStack EUVD-2026-51101

Q: What is the CVSS score of EUVD-2026-51101?

EUVD-2026-51101 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-54365 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-30 VulnCheck

GHSA-q7f4-j8r5-hmxq

Authentication Bypass Deserialization Microsoft Centrestack Gladinet

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, low-complexity, unauthenticated (PR:N/UI:N) endpoint creates OS accounts giving high integrity impact; no direct confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:22 vuln.today

CVE Published

Jul 30, 2026 - 12:25 cve.org

HIGH 8.7

DescriptionCVE.org

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacker-controlled credentials and create arbitrary directories on the server filesystem.

AnalysisAI

Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure deserialization path in GSNamespace.dll to add arbitrary local Windows accounts. By posting a crafted base64-encoded XML StorageConfigure value to the exposed jsonimportuserbyupn/jsonimportuserbyupnex/japiimportuserbyupn endpoints, an attacker (no credentials, per CVSS PR:N) drives InternalImportAdUserByUPN() to call NetUserAdd with attacker-chosen credentials and to create arbitrary server directories. No public exploit identified at time of analysis and it is not in CISA KEV, but the same product family has a prior history of actively exploited flaws, so weight this accordingly.

Technical ContextAI

CentreStack is Gladinet's enterprise file-sync-and-share / cloud gateway platform running on Windows (IIS/.NET), backed by native components such as GSNamespace.dll and the GladinetCloudMonitor.exe service. The root cause is CWE-306 (Missing Authentication for a Critical Function): user-import API endpoints intended for administrative AD provisioning are reachable without authentication and deserialize an attacker-supplied base64 XML blob (the StorageConfigure parameter). The deserialized object is passed into InternalImportAdUserByUPN(), which the monitor service uses to invoke the Windows NetUserAdd API - turning a data-import routine into a primitive for creating local OS accounts and filesystem directories under the service's privileges.

RemediationAI

Vendor-released patch: upgrade to CentreStack 17.3 or later, which remediates the unauthenticated deserialization path in GSNamespace.dll. Until patching is complete, restrict network exposure of the management/API surface - block or filter external access to the jsonimportuserbyupn, jsonimportuserbyupnex, and japiimportuserbyupn endpoints at the reverse proxy/WAF or firewall so only trusted management networks can reach them (trade-off: legitimate remote AD-import automation to those endpoints will break and must be re-scoped to the allowed network). Additionally audit local Windows accounts and newly created directories on CentreStack servers for unexpected entries created via NetUserAdd, and monitor GladinetCloudMonitor.exe account-creation activity. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/centrestack-unauthenticated-user-creation-via-deserialization-in-gsnamespace-dll) for detection detail and confirm the fixed build on the vendor site (https://www.centrestack.com/).