Hackers exploiting zero-day in Gladinet file sharing software

Threat actors are exploiting a zero-day Local File Inclusion (CVE-2025-11371) in Gladinet CentreStack and Triofox to retrieve the Web.config machine key and achieve remote code execution by chaining to a ViewState deserialization vulnerability (CVE-2025-30406). At least three companies were targeted; no patch is available yet and Huntress published mitigations (remove the temp handler in UploadDownloadProxy Web.config) while the vendor notifies customers.