CVE-2026-54365: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2026-54365 is an unauthenticated deserialization vulnerability in Gladinet CentreStack affecting all versions before 17.3. The flaw resides in GSNamespace.dll and allows unauthenticated remote attackers to create arbitrary local OS user accounts and directories on the server filesystem by supplying a crafted base64-encoded XML string to exposed API endpoints. It was published on July 30, 2026, with a patch available in version 17.3. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function), with a secondary estimate of CWE-502 (Deserialization of Untrusted Data). Attackers send a malicious StorageConfigure parameter — a crafted base64-encoded XML string — to one of three unauthenticated API endpoints: jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn. This triggers the InternalImportAdUserByUPN() function within GSNamespace.dll, which causes GladinetCloudMonitor.exe to invoke the Windows NetUserAdd API with attacker-controlled credentials, resulting in arbitrary local OS account creation and directory creation on the server filesystem. No authentication or user interaction is required, and the attack complexity is low (GitHub Advisory, VulnCheck).

Successful exploitation allows an unauthenticated remote attacker to create arbitrary local OS user accounts on the CentreStack server, which can be leveraged for persistent access, privilege escalation, or lateral movement within the network. Attackers can also create arbitrary directories on the server filesystem, potentially enabling further staging of malicious payloads. While confidentiality and availability impacts are rated as none in the CVSS scoring, the high integrity impact reflects the significant risk of unauthorized system modification and persistent attacker footholds (GitHub Advisory, VulnCheck).

1. Reconnaissance: Identify internet-facing CentreStack instances running versions prior to 17.3 using tools such as Shodan or Censys, searching for Gladinet CentreStack web interfaces.
2. Identify vulnerable endpoints: Locate the unauthenticated API endpoints — jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn — exposed on the target CentreStack server.
3. Craft malicious payload: Construct a base64-encoded XML string containing attacker-controlled user credentials (username, password) and desired directory paths, formatted to be accepted by the StorageConfigure parameter.
4. Send malicious request: Submit an HTTP POST request to one of the vulnerable endpoints (e.g., /jsonimportuserbyupn) with the crafted StorageConfigure parameter, requiring no authentication.
5. Trigger account creation: The server deserializes the XML payload via GSNamespace.dll, invoking InternalImportAdUserByUPN(), which causes GladinetCloudMonitor.exe to call the Windows NetUserAdd API, creating a local OS user account with attacker-specified credentials.
6. Establish persistence: Use the newly created local OS account to authenticate to the server via RDP, SMB, or other Windows services, establishing persistent access for further lateral movement or data exfiltration (GitHub Advisory, VulnCheck).

• Network: Unexpected HTTP POST requests to /jsonimportuserbyupn, /jsonimportuserbyupnex, or /japiimportuserbyupn endpoints from untrusted or external IP addresses; base64-encoded XML content in StorageConfigure POST parameters.
• Logs: CentreStack web server access logs showing unauthenticated requests to the above API endpoints; Windows Security Event Log entries for new local user account creation (Event ID 4720) initiated by GladinetCloudMonitor.exe.
• File System: Unexpected new directories created on the server filesystem by the CentreStack service account; presence of newly created local OS user accounts not provisioned by administrators.
• Process: GladinetCloudMonitor.exe spawning unusual child processes or making unexpected calls to Windows user management APIs (NetUserAdd).

Upgrade CentreStack to version 17.3 or later, which contains the patch for this vulnerability. As an interim workaround, restrict network access to the affected API endpoints (jsonimportuserbyupn, jsonimportuserbyupnex, japiimportuserbyupn) to trusted IP ranges only using firewall rules or web application firewall (WAF) policies. Additionally, implement network segmentation to limit the exposure of CentreStack instances to the public internet, and monitor Windows Security Event Logs for unexpected local account creation events (GitHub Advisory, VulnCheck).