CVE-2026-54365: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2026-54365 is an unauthenticated deserialization vulnerability in Gladinet CentreStack's GSNamespace.dll component that allows remote, unauthenticated attackers to create arbitrary local OS user accounts and directories on the server filesystem. It affects all CentreStack versions prior to 17.3 and was published on July 30, 2026. The CVE was assigned by VulnCheck and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function), with a secondary estimate of CWE-502 (Deserialization of Untrusted Data). The vulnerability resides in GSNamespace.dll, where the jsonimportuserbyupn, jsonimportuserbyupnex, and japiimportuserbyupn API endpoints accept a StorageConfigure parameter containing a crafted base64-encoded XML string without requiring authentication. Supplying a malicious payload triggers the InternalImportAdUserByUPN() function, which causes GladinetCloudMonitor.exe to invoke the Windows NetUserAdd API with attacker-controlled credentials, resulting in arbitrary local OS account creation and directory creation on the server filesystem (GitHub Advisory, VulnCheck Advisory).

Successful exploitation allows an unauthenticated remote attacker to create arbitrary local Windows OS user accounts on the CentreStack server, which can be leveraged for persistent access, privilege escalation, or lateral movement within the network. Attackers can also create arbitrary directories on the server filesystem, potentially enabling further staging of malicious files. While confidentiality and availability impacts are rated as none in the CVSS scoring, the high integrity impact reflects the significant risk of unauthorized system modification and persistent attacker footholds (GitHub Advisory, Feedly).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The NVD SSVC assessment confirms exploitation status as "none" and notes the attack is automatable with partial technical impact. The EPSS score is approximately 0.216% (12th percentile), indicating a currently low probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (GitHub Advisory).

1. Reconnaissance: Identify internet-facing CentreStack instances running versions prior to 17.3 using tools such as Shodan or Censys, searching for Gladinet CentreStack web interfaces.
2. Identify vulnerable endpoints: Locate the unauthenticated API endpoints — jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn — exposed on the target CentreStack server.
3. Craft malicious payload: Construct a base64-encoded XML string containing attacker-controlled user credentials (username, password) formatted to be accepted by the StorageConfigure parameter.
4. Send malicious request: Submit an HTTP POST request to one of the vulnerable endpoints (e.g., /jsonimportuserbyupn) with the crafted StorageConfigure parameter, requiring no authentication.
5. Trigger account creation: The server deserializes the XML payload and calls InternalImportAdUserByUPN(), which causes GladinetCloudMonitor.exe to invoke the Windows NetUserAdd API, creating a local OS user account with attacker-specified credentials.
6. Establish persistence: Use the newly created local OS account to authenticate to the server via RDP, SMB, or other Windows services for persistent access and further lateral movement (GitHub Advisory, VulnCheck Advisory).

• Network: Unexpected HTTP POST requests to /jsonimportuserbyupn, /jsonimportuserbyupnex, or /japiimportuserbyupn endpoints from untrusted or external IP addresses; base64-encoded XML content in StorageConfigure POST parameters.
• Logs: CentreStack web server access logs showing unauthenticated requests to the above API endpoints; Windows Security Event Log entries for new local user account creation (Event ID 4720) initiated by GladinetCloudMonitor.exe.
• File System: Unexpected new directories created on the server filesystem by the CentreStack service account; presence of newly created local OS user accounts not provisioned by administrators.
• Process: GladinetCloudMonitor.exe invoking NetUserAdd Windows API calls at unusual times or in response to external HTTP requests.

Gladinet has released CentreStack version 17.3, which addresses this vulnerability; organizations should upgrade immediately (GitHub Advisory). As interim mitigations, restrict network access to the affected API endpoints (jsonimportuserbyupn, jsonimportuserbyupnex, japiimportuserbyupn) to trusted IP ranges only using firewall rules or reverse proxy ACLs. Additionally, implement network segmentation to limit the exposure of CentreStack instances to the public internet, and monitor Windows Security Event Logs for unexpected local account creation events (VulnCheck Advisory).