Zero-Day in CentreStack File Sharing Platform Under Attack

A critical zero-day deserialization vulnerability (CVE-2025-30406) in Gladinet CentreStack, widely used by managed services providers, has been exploited in the wild since March; the flaw is caused by a hardcoded/improperly protected machineKey that enables crafted ViewState payloads to pass integrity checks and achieve remote code execution. CISA added the issue to its Known Exploited Vulnerabilities catalog, Gladinet advises upgrading to a version that generates unique machineKeys or rotating machineKey values as an interim mitigation, and federal agencies were given a patching deadline.