Gladinet maintains a narrow portfolio of cloud storage and file-sync products, CentreStack and Triofox, that serve as on-premises or hybrid data gateways and are often exposed to internet access. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and have a strong, recurring history of confirmed in-the-wild exploitation, coupled with frequent public exploit availability, driven by the high-value, authentication-adjacent attack surface represented by cloud-gateway and credential-management roles. The exposure recurs across these products through hard-coded credentials, world-accessible files and directories, improper access control, and unrestricted dangerous-file uploads—authentication and configuration weaknesses that directly compromise data confidentiality and governance in hybrid environments. Current exploitation activity, severity breakdown, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Gladinet over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-11371HIGH In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system | Oct 9, 2025 | 7.5 | 98 | YES | YES |
CVE-2025-30406CRITICAL Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited | Apr 3, 2025 | 9.8 | 98 | YES | YES |
CVE-2025-12480CRITICAL Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete. | Nov 10, 2025 | 9.1 | 97 | YES | YES |
CVE-2025-14611CRITICAL Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public expose | Dec 12, 2025 | 9.8 | 96 | YES | YES |
CVE-2026-8362CRITICAL A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long URL path starting with /woshome | May 27, 2026 | 9.8 | 35 | NO | NO |
CVE-2026-8363CRITICAL A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing a long URL path starting with /resources: | May 27, 2026 | 9.8 | 35 | NO | NO |
CVE-2026-8364CRITICAL Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes remote HTTP messages with URL paths starting with /resources, | May 27, 2026 | 9.8 | 35 | NO | NO |
CVE-2023-26829CRITICAL An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user acc | Mar 31, 2023 | 9.8 | 31 | NO | NO |
CVE-2026-8359HIGH When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_LoadHttpModule function | May 27, 2026 | 7.5 | 28 | NO | NO |
CVE-2026-8360HIGH Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL pointer (i.e., when no use | May 27, 2026 | 7.5 | 28 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Gladinet.
Media articles that mention a CVE ID that affects a product developed by Gladinet — matched by CVE ID, not by vendor name.