CISA Issues Alert on Gladinet CentreStack and Triofox Vulnerabilities Under Active Exploitation

According to CISA, the Cybersecurity and Infrastructure Security Agency has added a critical vulnerability affecting Gladinet CentreStack and Triofox to its Known Exploited Vulnerabilities catalog, signalling active exploitation in the wild. The flaw is tracked as CVE-2025-11371 and exposes sensitive system files to unauthorised external parties, posing a significant risk to organisations relying on these cloud file-sharing platforms.

CISA added CVE-2025-11371 to its Known Exploited Vulnerabilities catalog on 4 November 2025, with a compliance deadline of 25 November 2025, creating a three‑week window for federal agencies and critical infrastructure organisations to remediate. The article notes that the vulnerability arises from inadequate access controls, potentially allowing external threat actors to access files without proper authentication or authorisation.

It also outlines three mitigation pathways: apply all available patches from Gladinet per the vendor’s instructions; follow BOD 22-01 guidance for cloud security, emphasising monitoring, multi‑factor authentication and zero‑trust principles; and, if mitigations remain unavailable, consider discontinuing use of the affected CentreStack and Triofox products and inventory all instances in the infrastructure.