CVE-2026-54367 Gladinet CVE debrief

Who should care

Defenders responsible for CentreStack deployments should assess exposure and prioritize upgrading to version 17.2 or later if vulnerable. This includes operators managing CentreStack instances, platform administrators, vulnerability management teams, and security teams responsible for monitoring and mitigating potential threats. They should review the vulnerability details, assess the impact on their deployments, and take appropriate actions to mitigate or

Why it matters

CVE-2026-54367 is an authentication bypass vulnerability in CentreStack before version 17.2 that allows unauthenticated attackers to read, write, or delete arbitrary account settings. Defenders responsible for CentreStack deployments should assess exposure and prioritize upgrading to version 17.2 or later if vulnerable.

• Unauthenticated attackers can read, write, or delete arbitrary account settings.
• Enumeration of hosted tenant domains and administrator identities is possible.

Technical summary

The CVE-2026-54367 vulnerability is an authentication bypass issue in CentreStack before version 17.2. The vulnerability allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster settings account, enabling enumeration of hosted tenant domains and administrator identities. Defenders should prioritize verifying exposure of CentreStack API endpoints and upgrading to version 17.2 or later if vulnerable.

Defensive priority

Defenders should prioritize verifying exposure of CentreStack API endpoints and upgrading to version 17.2 or later if vulnerable.

Recommended defensive actions

• Verify CentreStack API endpoints for exposure and ensure authorization checks are in place.
• Upgrade to CentreStack version 17.2 or later if vulnerable.
• Monitor for suspicious activity on CentreStack API endpoints.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the authentication bypass vulnerability in CentreStack before version 17.2. The vulnerability allows unauthenticated attackers to read, write, or delete arbitrary account settings.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.