U.S. CISA adds Gladinet CentreStack, and CWP Control Web Panel flaws to its Known Exploited Vulnerabilities catalog

According to Security Affairs, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Gladinet CentreStack and CWP Control Web Panel flaws to its Known Exploited Vulnerabilities (KEV) catalog, alongside XWiki Platform. The entries include CVE-2025-11371 (CVSS 7.5) for Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties, and CVE-2025-48703 (CVSS 9.0) for CWP Control Web Panel OS Command Injection Vulnerability.

The report notes that CVE-2025-11371 is being exploited via a local File Inclusion flaw, and that Gladinet and Huntress have issued a workaround, with at least three customers reported as targeted so far. It also states that CVE-2025-48703 was disclosed by Maxime Rinaudo in June 2025, with exploitation demonstrated pre-authentication on some versions before it was patched in version 0.9.8.1205 during June 2025.

CISA orders federal agencies to fix the vulnerabilities by 25 November 2025, according to the Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities.