CVE-2026-54365
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll. An unauthenticated attacker can supply a crafted base64-encoded XML string to exposed API endpoints, triggering creation of arbitrary local OS user accounts via the NetUserAdd Windows API.
Risk Assessment
The risk is creation of unauthorized OS user accounts, potentially leading to privilege escalation and server compromise.
Recommendation
Immediately upgrade CentreStack to version 17.3 or later, which includes a fix.
Other vulnerabilities in CentreStack
See all- CVE-2026-54368High
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can supply a crafted x-glad-filter header via the jsondir API endpoint, leading to arbitrary SQL execution and file writes using PostgreSQL functions, enabling remote code execution.
- CVE-2026-54367High
CentreStack before 17.2 contains an authentication bypass vulnerability. An unauthenticated attacker can read, write, or delete arbitrary account settings by exploiting exposed API endpoints lacking authorization checks. Attackers can forge valid encrypted EntAcctId values using a static shared encryption key, enabling enumeration of tenant domains and administrator identities.
- CVE-2026-54366High
CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability. An unauthenticated attacker can supply a malicious URL to the SharePoint storage configuration handler, causing the server to fetch and parse attacker-controlled XML with external DTD references, leading to exfiltration of files such as Web.config containing database credentials and cryptographic keys.
- CVE-2026-54364Medium
CentreStack before version 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.
- CVE-2026-54363Critical
CentreStack before version 17.5 contains a hardcoded cryptographic key vulnerability, allowing unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt(). Attackers can craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.
Original NVD description (English source)
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacker-controlled credentials and create arbitrary directories on the server filesystem.