Threat actors are actively exploiting a critical zero-day vulnerability in Gladinet’s CentreStack and Triofox platforms, which enables unauthenticated Local File Inclusion (LFI) leading to full system compromise. Discovered by Huntress on September 27, 2025, the flaw (tracked as (CVE-2025-11371) allows attackers to read sensitive configuration files (specifically Web.config) to extract machine keys and chain the attack with a prior deserialization bug (CVE-2025-30406), achieving remote code execution (RCE) through ViewState abuse. The vulnerability affects all current and previous product versions, including 16.7.10368.56560, with no patch currently available. At least three (3) companies have already been targeted. Gladinet confirmed awareness and is notifying customers of temporary mitigations, which involve disabling the vulnerable temp handler in UploadDownloadProxy/Web.config. Although this workaround disrupts some platform functionality, it effectively blocks exploitation while users await an official fix. CTIX analysts urge any affected admins to follow the manual mitigation techniques provided by Gladinet and monitor for when a full patch is released.