Gladinet CentreStack < 17.5 — hardcoded cryptographic key (static SysNumber) forges AccessTickets and x-glad-auth headers, reaching a domain-administrator IdentityTicket and unauthenticated RCE (CVSS 9.3)

CVE-2026-54363 and five siblings — Gladinet CentreStack: one cryptographic key shared across every installation forges a domain-administrator token, completing an unauthenticated RCE chain

Gladinet CentreStack is an enterprise file-sharing and sync platform typically deployed as an internet-facing portal, and on 2026-07-30 six vulnerabilities in it were disclosed with per-flaw technical write-ups. This entry is first coverage of that disclosure rather than a report of something that happened today — no development has moved it since, and the dates here are the disclosure's own. The reason it still matters three days on is the shape of the lead flaw and the platform's history: three earlier CentreStack vulnerabilities — CVE-2025-30406, CVE-2025-11371 and CVE-2025-14611 — have been added to the US authorities' catalog of exploited vulnerabilities, so this product line has a demonstrated record of disclosure being followed by in-the-wild abuse.

The lead flaw is CVE-2026-54363, and its defect is that the secret is not a secret. The advisory states that CentreStack "contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations" (VulnCheck, 2026-07-30). Because that value is the same everywhere rather than generated per deployment, anyone who extracts it once can forge tokens against every CentreStack on the internet: the advisory continues that attackers "can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain" (VulnCheck, 2026-07-30). There is no authentication step to defeat and no user to phish — it is a forged header on a request.

The five siblings are independent bugs rather than variants, and they are fixed in four different releases, which is the practical trap in this batch. CVE-2026-54367 lets an unauthenticated caller read, write or delete account settings for any user GUID — including the system-wide cluster settings account — by generating valid encrypted EntAcctId values with a static shared encryption key, exposing hosted tenant domains and administrator identities (VulnCheck, 2026-07-30). CVE-2026-54365 is an unauthenticated deserialization flaw in GSNamespace.dll: a crafted base64-encoded XML StorageConfigure parameter sent to one of three import endpoints reaches InternalImportAdUserByUPN(), which causes GladinetCloudMonitor.exe to call the Windows NetUserAdd API and create local OS accounts with attacker-chosen credentials (VulnCheck, 2026-07-30). CVE-2026-54366 is an XXE at the unauthenticated SharePoint StorageConfig endpoint that exfiltrates files out-of-band, Web.config among them (VulnCheck, 2026-07-30). CVE-2026-54364 injects session variables by embedding newline and tab characters in an AccountName parameter posted to SelectProvider.aspx, forging a resellerid variable that bypasses the IsValidRSession check (VulnCheck, 2026-07-30). CVE-2026-54368 is the only member requiring authentication: unsanitised interpolation of a Field parameter from the x-glad-filter header into GladDBFiles.SearchEx() reaches arbitrary SQL, and via PostgreSQL's large-object functions, arbitrary file writes to the server filesystem (VulnCheck, 2026-07-30).

Detection follows the fact that every unauthenticated path here is an HTTP request to a named endpoint, so web-server and application access logs are the primary telemetry, not the endpoint agent. The observable classes are requests carrying an x-glad-auth header from source addresses that are not an established client, requests to the tenant-backup-token endpoint at all (a privileged administrative call that has no reason to arrive from the open internet), POSTs to the user-import endpoints named above, and x-glad-filter header values containing SQL syntax. On the host, the durable artifact of the account-creation flaw is a local OS account appearing without a corresponding administrative action, and the process lineage to look for is the CentreStack monitor service creating accounts or directories. Discriminating benign traffic is mostly a question of origin and endpoint pairing: legitimate CentreStack clients authenticate through the normal portal flow and do not call tenant-backup or user-import endpoints directly, so it is the combination of a privileged endpoint and an unexpected caller — rather than either alone — that is the signal. No proof-of-concept is public and no exploitation is reported for any of the six.