CVE-2026-8364: Gladinet Triofox Auth Bypass Vulnerability

CVE-2026-8364 Overview

CVE-2026-8364 is a missing authentication vulnerability [CWE-306] in the Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe). The service listens on TCP port 7878 and processes remote HTTP messages without authenticating callers. Affected URL paths include /resources, /status, /sysinfo, /woshome, /Settings, /schedule, and /DavCache. Remote attackers can reach these endpoints over the network without credentials or user interaction, leading to compromise of confidentiality, integrity, and availability.

Critical Impact
Unauthenticated network attackers can interact with privileged Triofox agent endpoints on TCP port 7878, enabling remote compromise of affected servers.

Affected Products

Gladinet Triofox Cloud Server Agent (GladServerAgentService.exe)
Triofox deployments exposing TCP port 7878
Server installations bundling the Gladinet agent service

Discovery Timeline

2026-05-27 - CVE-2026-8364 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8364

Vulnerability Analysis

The Gladinet Triofox Cloud Server Agent Access Service exposes an HTTP listener on TCP port 7878. The service handles requests targeting /resources, /status, /sysinfo, /woshome, /Settings, /schedule, and /DavCache. These endpoints process configuration, scheduling, and cache operations that influence server behavior.

The service does not require authentication before processing these requests. Any client able to reach port 7878 can interact with the listed endpoints. The vulnerability impacts confidentiality, integrity, and availability of the host running the agent.

For full technical details, see the Tenable Security Research Advisory.

Root Cause

The root cause is missing authentication on a privileged HTTP listener [CWE-306]. The agent service trusts inbound HTTP messages without validating the identity of the caller. Endpoints handling system information and configuration should require authenticated, authorized requests.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to TCP port 7878 on a vulnerable Triofox host. No prior credentials, tokens, or user interaction are needed. Exploitation succeeds against any deployment where port 7878 is reachable from the attacker's network position.

No verified public exploit code was available at the time of writing. The vulnerability mechanism is described in prose because no realCodeExamples were provided.

Detection Methods for CVE-2026-8364

Indicators of Compromise

Unexpected inbound TCP connections to port 7878 from untrusted networks or external addresses.
HTTP requests to /resources, /status, /sysinfo, /woshome, /Settings, /schedule, or /DavCache originating from unknown clients.
Modifications to Triofox configuration, scheduled tasks, or DAV cache contents without administrator action.

Detection Strategies

Inspect web and proxy logs for requests to the seven vulnerable URL paths on port 7878.
Alert on access to GladServerAgentService.exe endpoints from sources outside the documented management subnet.
Correlate process activity from GladServerAgentService.exe with subsequent file, registry, or scheduled task changes.

Monitoring Recommendations

Enable verbose HTTP request logging on the Triofox agent listener and forward logs to a central SIEM.
Monitor firewall and netflow data for new external sources reaching port 7878.
Track service restarts, configuration writes, and changes to scheduled jobs on Triofox servers.

How to Mitigate CVE-2026-8364

Immediate Actions Required

Restrict TCP port 7878 to trusted management hosts using host and network firewalls.
Remove direct internet exposure of any Triofox server running GladServerAgentService.exe.
Review logs since deployment for unauthenticated access to the affected URL paths.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Consult the Tenable Security Research Advisory and Gladinet support channels for vendor-supplied updates. Apply vendor patches as soon as they become available.

Workarounds

Block inbound traffic to TCP port 7878 at perimeter and host firewalls except from a defined management allowlist.
Place Triofox servers behind a VPN or zero-trust gateway that enforces authentication before reaching the agent.
Disable the GladServerAgentService Windows service on hosts that do not require the agent functionality.

bash

# Configuration example: restrict access to TCP 7878 on Windows
New-NetFirewallRule -DisplayName "Block Triofox Agent 7878 Inbound" \
  -Direction Inbound -Protocol TCP -LocalPort 7878 -Action Block

New-NetFirewallRule -DisplayName "Allow Triofox Agent 7878 Management" \
  -Direction Inbound -Protocol TCP -LocalPort 7878 \
  -RemoteAddress 10.0.0.0/24 -Action Allow