Search: CVE-2025-11371

CVE-2025-11371 is an unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and TrioFox. It affects all versions up to and including 16.7.10368.56560. This flaw allows attackers to disclose system files without authentication. Exploitation has been observed in the wild. The vulnerability has a high severity rating with a CVSS score of 7.5.

A Microsoft 365 API credential for ConnectWise Cloud Backup (formerly SkyKick) was compromised and used by an attacker to access hundreds of customer M365 environments. The attacker obtained Microsoft Graph access tokens and moved through tenants in an automated fashion. In at least one case, the ConnectWise Cloud Management MS Teams application was elevated to Global Administrator, allowing the attacker to add credentials to other applications, including security tools. The campaign started with password spraying against law firms, followed by role assignments in about 50 tenants, and widespread credential abuse across nearly 1,000 Entra tenants. A second wave targeted 16 tenants in sensitive sectors such as policy, national security, trade, and critical minerals. No official patch or remediation guidance is currently available.