CVE-2026-54366: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2026-54366 is an XML External Entity (XXE) injection vulnerability in Gladinet CentreStack affecting all versions before 17.4. The flaw exists in the SharePoint storage configuration handler and allows unauthenticated remote attackers to exfiltrate arbitrary files from the server, including sensitive configuration files containing database credentials and cryptographic key material. It was published on July 30, 2026, with a patch available in version 17.4. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The unauthenticated StorageConfig endpoint, which handles SharePoint storage configuration, accepts a user-supplied URL without adequate validation. An attacker can supply a malicious URL pointing to attacker-controlled XML containing external DTD references; the server fetches and parses this XML, triggering out-of-band (OOB) data exfiltration. Because the endpoint requires no authentication and the attack complexity is low, exploitation can be fully automated (GitHub Advisory, VulnCheck Advisory).

Successful exploitation allows unauthenticated network attackers to read arbitrary files on the CentreStack server. The most critical exposure is the Web.config file, which may contain database connection strings, credentials, and cryptographic key material. Compromise of these secrets could enable further attacks such as database access, decryption of protected data, or lateral movement within the environment. There is no integrity or availability impact directly from this vulnerability, but the confidentiality impact is rated High (GitHub Advisory).

1. Reconnaissance: Identify internet-facing CentreStack instances running versions prior to 17.4 using tools like Shodan or Censys, searching for CentreStack-specific HTTP response headers or login pages.
2. Locate the vulnerable endpoint: Target the unauthenticated StorageConfig endpoint (associated with SharePoint storage configuration) — no credentials are required.
3. Set up an OOB exfiltration server: Host a malicious XML file on an attacker-controlled server (e.g., using Burp Collaborator, interactsh, or a custom HTTP server) that contains an external DTD reference pointing back to the attacker's server with a file URI payload (e.g., file:///C:/inetpub/wwwroot/centrestack/Web.config).
4. Craft and send the malicious request: Submit a crafted HTTP request to the StorageConfig endpoint supplying the attacker-controlled URL as the SharePoint storage configuration URL parameter.
5. Receive exfiltrated data: The CentreStack server fetches the attacker's XML, resolves the external entity, and transmits the contents of the targeted file (e.g., Web.config) to the attacker's OOB server.
6. Leverage extracted secrets: Parse the received Web.config for database credentials, API keys, or cryptographic material to enable further compromise (GitHub Advisory, VulnCheck Advisory).

• Network: Outbound HTTP/HTTPS requests from the CentreStack server to unexpected external IP addresses or domains, particularly shortly after requests to the StorageConfig endpoint; DNS lookups to attacker-controlled domains originating from the CentreStack server process.
• Logs: IIS or web server access logs showing POST or GET requests to the StorageConfig endpoint with unusual or external URLs as parameters; error log entries related to XML parsing or DTD resolution failures.
• File System: No direct file system artifacts are expected from read-only XXE exploitation, but review for any unexpected file access patterns in Windows event logs (e.g., access to Web.config by the IIS worker process at unusual times).
• Process: Unusual outbound network connections initiated by the IIS worker process (w3wp.exe) to external hosts not associated with normal CentreStack operations.

Upgrade CentreStack to version 17.4 or later, which contains the fix for this vulnerability. As an interim workaround, restrict network access to the StorageConfig endpoint so that only trusted administrators can reach it (e.g., via firewall rules or network segmentation). Additionally, implement XML parser hardening by disabling external entity resolution and DTD processing at the application or server level where possible (GitHub Advisory, VulnCheck Advisory).