Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck

CVE-2026-54364CentreStack < 17.4 Session Injection via SelectProvider.aspx

Medium 6.5

In plain English

A medium-severity security flaw in CentreStack from Gladinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.

Affected products (as reported)

Vendor	Product	Versions
Gladinet	CentreStack	0 – before 17.4

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Product Homepage product
https://www.vulncheck.com/advisories/centrestack-session-injection-via-selectprovider-aspx third-party-advisory