VulnSocial

CVE-2026-54363Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as acquiretenantbackuptoken to obtain a domain administrator IdentityTicket, enabling a complete unauthenticated remote code execution chain.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-31); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-31: 1Mentions · 2026-09-06: 1Technical Details · 2026-07-31: 107-3109-06
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-311
Disclosure1
2026-09-061
General1
Full discourse2 posts
  • ThreatAft@ThreatAft
    Disclosure

    🔐 🚨 CentreStack 4-CVE Bundle — Hardcoded Crypto + Deserialization + Auth Bypass + SQLi CVE-2026-54363 (9.1), 54365 (7.5), 54367 (8.6), 54368 (8.8) → http://threataft.com/articles/centrestack-cve-bundle-4-cves #cybersecurity #infosec #CentreStack #CloudSecurity #ThreatIntel

    Post summary

    The message announces a 4‑CVE bundle affecting CentreStack, providing CVE identifiers, CVSS scores, and type of vulnerabilities without any exploitation, patch, or PoC details.

    0001067
    35 followersView on X
  • IntegSec@integ_sec
    General

    CVE-2026-54363: CentreStack Hardcoded Cryptographic Key Bug - What It Means for Your Business and How to Respond https://hubs.ly/Q04wPN6y0

    Post summary

    The article’s headline references CVE-2026-54363 and suggests business‑level response steps, but offers no specific technical, exploit, patch, or active‑exploitation information.

    0000030
    35 followersView on X

Explore more

Back to dashboard