CVE-2026-54365
Received Received - Intake

Unauthenticated Deserialization Flaw in CentreStack

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacker-controlled credentials and create arbitrary directories on the server filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-54365
EUVD
EUVD-2026-51101

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
centrestack centrestack to 17.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CentreStack before version 17.3 has an unauthenticated deserialization vulnerability in GSNamespace.dll. Attackers can exploit this by sending a crafted base64-encoded XML string to specific API endpoints to create arbitrary local OS user accounts without authentication. The vulnerability allows triggering InternalImportAdUserByUPN() which uses NetUserAdd API to create users and directories.

Detection Guidance

Check CentreStack logs for unusual API calls to jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints. Monitor for unexpected local user account creations via Windows Event Logs under Security > Event ID 4720.

Impact Analysis

This vulnerability allows unauthenticated attackers to create arbitrary local user accounts on the system. They can then gain unauthorized access, escalate privileges, or manipulate server files by creating directories. The impact includes potential data breaches, system compromise, and loss of control over the affected CentreStack server.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for GDPR (data protection), HIPAA (health information security), and other regulations. It undermines access controls, audit trails, and data integrity, potentially resulting in legal penalties and loss of certification.

Mitigation Strategies

Upgrade CentreStack to version 17.3 or later immediately. Block external access to the vulnerable API endpoints if not required. Review and remove any unauthorized local user accounts created since the vulnerability's discovery.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54365. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart