CVE-2026-54365

CentreStack prior to version 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll. An attacker can send a crafted base64-encoded XML via exposed API endpoints (jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn) to trigger InternalImportAdUserByUPN(), ...