CVE-2026-54363

Name of the Vulnerable Software and Affected Versions CentreStack versions prior to 17.5

Description The software contains a hardcoded cryptographic key. Unauthenticated attackers can exploit a static SysNumber value used as entropy for the AccessTicket.Encrypt() and AccessTicket.Decrypt() functions across all installations to forge arbitrary encrypted tokens. By using this hardcoded key, attackers can craft valid x-glad-auth headers to access privileged API endpoints, such as 'acquiretenantbackuptoken', to obtain a domain administrator IdentityTicket. This sequence allows for a complete unauthenticated remote code execution chain.

Recommendations Update CentreStack to version 17.5 or later.