CVE-2025-11371Vulnerability
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 10 months ago
CISA KEVAdded 4 Nov 2025
Fix due 25 Nov 2025
Used by ransomware: not knownCISA KEV catalogue
Fix due 25 Nov 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS92.1%
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Gladinet CentreStack/Triofox: Cryptography Vulnerability“The threat actor connected from IP address 147.124.216.205 and attempted to use the exploit (CVE-2025-11371) followed by the new exploit to obtain the web.config file containing the machine key.”
-
Active Exploitation of Gladinet CentreStack and Triofox“Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion Flaw (CVE-2025-11371)”
Indicators reported together
named in the same reports- hxxp://185.196.11[.]207:8000/conqueror.exein 1 report
- 185.196.11[.]207in 1 report
- hxxp://185.196.11[.]207:8000in 1 report
- e9fa82d92d826c6a…4393be64b5a5in 1 report
- 146.70.134[.]50in 1 report
- 147.124.216[.]205in 1 report
- en.fofa[.]infoin 1 report
Copy these 7 indicators · defanged
Also named with it: CVE-2025-30406, CVE-2025-14611
Thanks — we review every report.