Hackers exploiting zero-day in Gladinet file sharing software

Threat actors are exploiting a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and Triofox products, which allows a local attacker to access system files without authentication. At least three companies have been targeted so far. Although a patch is not yet available, customers can apply mitigations. CentreStack and Triofox are Gladinet's business solutions for file sharing and remote access that allow using a company's own storage as a cloud. According to the vendor, CentreStack "is used by thousands of businesses from over 49 countries." The zero-day vulnerability CVE-2025-11371 is a Local File Inclusion (LFI) flaw affecting the default installation and configuration of both products, impacting all versions  including the latest release, 16.7.10368.56560. Researchers at managed cybersecurity platform Huntress detected the security issue on September 27 when a threat actor successfully exploited it to obtain a machine key and execute code remotely. A closer analysis revealed that the issue was an LFI leveraged to read the Web.config and extract the machine key. This allowed the attacker to use an older deserialization vulnerability (CVE-2025-30406) and achieve remote code execution (RCE) through ViewState. The CVE-2025-30406 deserialization bug in CentreStack and Triofox was also exploited in the wild in March, and was due to a hardcoded machine key. An attacker knowing the key could perform RCE on an affected system. “After subsequent analysis, Huntress dis...