CVE-2026-54363 Gladinet CVE debrief

Who should care

CentreStack administrators, security teams, and IT professionals responsible for CentreStack installations should verify their systems, specifically checking version numbers and configurations. They should apply patches if necessary and implement compensating controls to mitigate the risk. Additionally, they should review API endpoint access controls and authentication mechanisms, monitor for suspicious activity, and track exceptions and retest remediated

Why it matters

CVE-2026-54363 is a critical vulnerability in CentreStack that requires immediate attention from administrators and security teams. The hardcoded cryptographic key allows unauthenticated attackers to forge encrypted tokens, potentially leading to remote code execution. CentreStack administrators should verify their installations, apply patches if necessary, and implement compensating controls to mitigate the risk.

• Potential for unauthenticated remote code execution
• Need for urgent patching or mitigation
• Possible impact on CentreStack installations
• Requirement for verification of affected versions and remediation steps

Technical summary

CentreStack before version 17.5 uses a hardcoded cryptographic key, allowing unauthenticated attackers to forge arbitrary encrypted tokens. This can be exploited to craft valid x-glad-auth headers and call privileged API endpoints, potentially leading to remote code execution. The CentreStack software uses a static SysNumber value as entropy for AccessTicket encryption and decryption across all installations, enabling attackers to obtain a domain administrator IdentityTicket and enabling a complete unauthenticated remote code execution chain.

Defensive priority

High priority for CentreStack administrators to verify exposure and apply patches

Recommended defensive actions

• Verify CentreStack version and apply patches if necessary
• Review API endpoint access controls and authentication mechanisms
• Monitor for suspicious activity and implement compensating controls if needed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. CentreStack administrators should verify their installations, specifically checking version numbers and configurations, and apply patches if necessary. Evidence is limited to public sources, and defenders should verify affected scope and remediation steps with official documentation. CentreStack uses a static SysNumber value as entropy for AccessTicket encryption and decryption across all installations, enabling attackers to craft valid x-glad-auth headers and call to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.