PT-2026-44098 · Gladinet · Triofox Cloud Server Agent

Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-8364

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gladinet Triofox Cloud Server Agent (affected versions not specified)

Description Improper handling of remote HTTP messages in the GladServerAgentService.exe, which listens on TCP port 7878, allows unauthenticated attackers to potentially gain unauthorized access or control. The issue occurs when processing requests sent to the following API endpoints: "/resources", "/status", "/sysinfo", "/woshome", "/Settings", "/schedule", and "/DavCache".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-8364

Affected Products

Triofox Cloud Server Agent

References · 5

• 🔥 https://tenable.com/security/research/TRA-2026-45 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8364 · Security Note
• https://t.me/CVEtracker/55158 · Telegram Post
• https://t.me/cveNotify/164944 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1tq7jsz/critical_vulnerability_found_in_gladinet_triofox · Reddit Post