Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to gain administrative-level visibility and control over the platform's account settings. This leads to the exposure of sensitive organizational tenant information, potential account takeover of administrative roles, and the ability to modify core system configurations. The compromise of tenant enumeration and administrative identity metadata significantly increases the risk of further targeted attacks against the organization's infrastructure.

Recommendation

• Upgrade all CentreStack deployments to version 17.2 or later immediately to remediate CVE-2026-54367.
• Review web server access logs for anomalous, high-frequency POST or GET requests targeting API endpoints associated with user or cluster setting management.
• Perform a security audit of current administrative accounts to ensure no unauthorized identities or modified settings were introduced while the system was unpatched.

Attack Chain

1. Attacker identifies the target instance of CentreStack accessible via the internet.
2. Attacker crafts an XML payload containing a malicious external DTD reference targeting a local file (e.g., Web.config).
3. Attacker sends an unauthenticated HTTP POST request to the /StorageConfig endpoint of the CentreStack application.
4. The application processes the malicious XML payload within the SharePoint storage configuration handler.
5. The server performs an out-of-band request to the attacker-controlled DTD server as instructed by the XXE payload.
6. The server reads the target file content and includes it in the communication or triggers a side-channel exfiltration of the data.
7. The attacker captures the exfiltrated sensitive data, such as database credentials or encryption keys, from their controlled server.
8. Attacker uses the stolen credentials to gain persistent or elevated access to the CentreStack backend and associated storage environments.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files from the filesystem of the hosting server. In typical enterprise deployments, this leads to the compromise of Web.config files, resulting in the theft of database connection strings, administrative credentials, and cryptographic keys. This impact compromises the confidentiality of all data managed by the CentreStack instance and enables further lateral movement into linked storage services like SharePoint.

Recommendation

1. Upgrade all instances of CentreStack to version 17.4 or later immediately to patch CVE-2026-54366.
2. Deploy the provided Sigma rule to webserver access logs to detect potential XXE probe attempts targeting the StorageConfig endpoint.
3. Review web server logs for HTTP requests to the StorageConfig endpoint originating from unexpected or untrusted external IP addresses.
4. If an instance was compromised, rotate all database credentials, API keys, and cryptographic secrets stored within Web.config and application settings.

Attack Chain

1. An unauthenticated attacker identifies an internet-facing CentreStack instance.
2. The attacker uses the known hardcoded 'SysNumber' to replicate the encryption routine used for AccessTicket generation.
3. The attacker crafts a malicious 'x-glad-auth' HTTP header using the forged token.
4. The attacker sends a crafted request to the 'acquiretenantbackuptoken' privileged API endpoint.
5. The backend service validates the forged token as authentic due to the static entropy key.
6. The server returns a high-privileged Domain Administrator IdentityTicket to the attacker.
7. The attacker uses the stolen IdentityTicket to authenticate to administrative API endpoints.
8. The attacker interacts with file management or configuration APIs to execute arbitrary commands on the host server.

Impact

Successful exploitation of this vulnerability leads to full unauthenticated remote code execution on the affected CentreStack server. This allows for complete data exfiltration, modification of system configurations, and lateral movement within the corporate network. Because this is a systemic vulnerability in the product's cryptographic implementation, all installations prior to version 17.5 are at risk of total compromise without requiring prior knowledge of legitimate user credentials.

Recommendation

Prioritized actions for detection engineering teams:

• Upgrade CentreStack instances to version 17.5 or later immediately as the primary remediation for CVE-2026-54363.
• Monitor web server logs for anomalous 'POST' or 'GET' requests to the '/acquiretenantbackuptoken' API endpoint originating from non-authenticated or external IP addresses.
• Implement strict network perimeter controls to restrict access to CentreStack management API endpoints to trusted internal IP ranges only.
• Deploy WAF rules to inspect and filter suspicious 'x-glad-auth' headers that deviate from expected token formatting or originate from suspicious sources.