CVE-2026-54363 describes a hardcoded cryptographic key vulnerability in Gladinet CentreStack before version 17.5. The vulnerability arises from the use of a static SysNumber value as entropy in the AccessTicket.Encrypt() and AccessTicket.Decrypt() methods, enabling attackers to forge arbitrary encrypted tokens without authentication. By leveraging this, attackers can create valid x-glad-auth headers to call privileged API endpoints such as acquiretenantbackuptoken, which can yield a domain administrator IdentityTicket. This chain of exploitation allows complete unauthenticated remote code execution on affected systems.

An unauthenticated attacker can exploit the hardcoded cryptographic key to forge encrypted tokens and gain privileged access to API endpoints. This can result in obtaining a domain administrator IdentityTicket and executing remote code with high privileges, compromising the entire system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to CentreStack API endpoints and monitor for suspicious activity related to token usage. Avoid exposing CentreStack installations to untrusted networks.