In early 2025, a critical zero-day vulnerability was discovered in Gladinet CentreStack, a widely used enterprise file-sharing platform that transforms on-premises file servers into cloud-like systems. The flaw, tracked as CVE-2025-30406, which has been exploited in the wild since March, stems from a hardcoded or improperly protected machineKey in the IIS configuration files used for ASP.NET ViewState integrity verification. If obtained or predicted by attackers, this key allows the forging of ViewState payloads, potentially leading to remote code execution (RCE) on the server. Gladinet issued a patch on April 3, 2025, in versions 16.4.10315.56368 and newer, which now generate a secure machineKey by default. Organizations are urged to update immediately or rotate machineKeys as a temporary measure, ensuring consistency across servers and restarting IIS afterward. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, setting an April 29, 2025 deadline for Federal Civilian executive Branch (FCEB) agencies to apply the mitigations. Although there is no confirmed ransomware activity yet, the nature of the vulnerability raises concerns about potential data theft, especially given the history of exploitation by groups like the Clop ransomware gang. CISA’s alert also included a separate zero-day Windows vulnerability (CVE-2025-29824), a use-after-free issue in the CLFS driver exploited via the PipeMagic malware for local privilege escalation, underscoring a broader need for urgent patching across enterprise systems.