CRITICAL 9.3 NVD
CVE-2026-54363
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploi
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.
References
- https://www.centrestack.com/
- https://www.vulncheck.com/advisories/centrestack-hardcoded-key-token-forgery-rce
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-07-30 via NVD.
Risk Timeline
CVE Disclosed2026-07-30 · 4 days ago
Remediation Resources
Analysis & PoC
www.centrestack.com/
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.