CISA Warns of Gladinet CentreStack and Triofox Vulnerability Exploited in Attacks

CISA warns of CVE-2025-14611: a hardcoded AES key vulnerability in Gladinet CentreStack and Triofox that allows unauthenticated remote actors to bypass authentication and perform arbitrary file inclusion, risking data exfiltration; organizations are urged to apply patches or mitigations immediately, follow BOD 22-01 guidance, or discontinue affected products by the January 5, 2026 remediation deadline, and to implement enhanced monitoring and network segmentation.