CVE-2026-54363 describes a vulnerability in Gladinet CentreStack prior to version 17.5 where a hardcoded cryptographic key is used as entropy in AccessTicket.Encrypt() and AccessTicket.Decrypt(). This static SysNumber value allows unauthenticated attackers to forge arbitrary encrypted tokens, including valid x-glad-auth headers. By exploiting this, attackers can call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a full unauthenticated remote code execution chain. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

The vulnerability allows unauthenticated remote attackers to forge encrypted tokens and gain privileged access to API endpoints. This can lead to obtaining domain administrator credentials and executing arbitrary code remotely without authentication, compromising the entire affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 17.5, upgrading to version 17.5 or later is implied as a remediation step. Until an official fix or advisory is available, restrict access to CentreStack management interfaces and monitor for suspicious API calls.