CVE-2026-8364: Gladinet Triofox Missing Authentication for Critical Functions

Synopsis

Authentication bypass (missing authentication for critical functions) affects Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe). The service listens on TCP port 7878 and processes unauthenticated remote HTTP requests to several sensitive URL paths, reachable over the network with no credentials or user interaction required, as reflected in the CVSS vector (AV:N/PR:N/UI:N). Successful exploitation gives an attacker full read, write, and availability impact against the affected host. A patched-image rebuild at version 17.3.10565.57509 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach TCP port 7878 on the host running GladServerAgentService.exe over the network; any system with network access to that port is within scope.

• AuthenticationNot required

  No credentials of any kind are required; the affected HTTP endpoints accept unauthenticated requests from any caller.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends HTTP requests directly to the service without any victim involvement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of the target environment beyond network access.

Blast Radius

• Reads sensitive configuration, system information, scheduling data, and cached file paths exposed by the /sysinfo, /Settings, /schedule, and /DavCache endpoints.
• Modifies persisted settings and cached data via writable endpoints, enabling tampering with server behavior or stored file references.
• Disrupts availability of the Cloud Server Agent service, potentially taking file-sharing and sync operations offline for connected users.
• Combines confidentiality and integrity access to pivot further into the host or connected storage back-ends using harvested configuration secrets.