A static cryptographic key said to be shared across all CentreStack installations would let unauthenticated attackers forge authentication tokens and chain them into full remote code execution.
What Is It
CVE-2026-54363 is a hardcoded cryptographic key vulnerability (CWE-321) in Gladinet CentreStack. According to a VulnCheck advisory, currently the only public technical source for the exploitation details below, the product uses a static SysNumber value as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt(), and that value is identical across every installation. If the key is not unique per deployment, an attacker who knows it could forge arbitrary encrypted tokens without any credentials.
VulnCheck describes the practical path as crafting valid x-glad-auth headers and calling privileged API endpoints, including acquiretenantbackuptoken, to obtain a domain administrator IdentityTicket, completing an unauthenticated remote code execution chain. These specifics have not been independently corroborated, and the NVD record is still in "Received" status without vendor or NVD analysis to confirm them.
Why It Matters
The CVSS v3.1 base score is 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. A CVSS v4.0 score of 9.3 (CRITICAL) was also assigned. As scored, the attack is network-reachable, low complexity, and requires no privileges and no user interaction; confidentiality and integrity impact are both HIGH.
The shared-key design is the aggravating factor, if it holds as described. With no per-install variation to slow an attacker down, one key would work everywhere, making the path from network reachability to domain administrator short and repeatable.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation to report from the source material provided.
What's Vulnerable
- Vendor: Gladinet
- Product: CentreStack
- Affected versions: all versions before 17.5 (default status: affected)
No CPE match data was present in the supplied NVD record, so the affected-version range has not been machine-validated.
Patch Status
The vulnerability is reported fixed in CentreStack 17.5. Organizations running any earlier version should upgrade to 17.5 or later. The supplied NVD record lists no CISA-mandated remediation deadline, no workaround, and no mitigation short of upgrading. NVD status at time of writing is "Received," published 2026-07-30; the record has not yet completed analysis, so scoring and affected-version data may change.
Sources
- NVD, CVE-2026-54363: https://nvd.nist.gov/vuln/detail/CVE-2026-54363
- VulnCheck Advisory; CentreStack Hardcoded Key Token Forgery RCE: https://www.vulncheck.com/advisories/centrestack-hardcoded-key-token-forgery-rce
- Gladinet CentreStack: https://www.centrestack.com/