Executive brief
Gladinet Triofox Server Agent is a software component used to facilitate secure remote access and file synchronization. A vulnerability in how the server handles specific web requests can cause the application to crash. An unauthenticated attacker can exploit this by sending a specially crafted web request, leading to a denial-of-service condition that disrupts remote file access for users.
Technical details
A NULL pointer dereference exists in the Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe). When the service receives an HTTP request with a URL path starting with /status or /sysinfo, it attempts to load WOSHttpStatusModule.dll and call the exported function WOSBin_LoadHttpModule. Because this DLL is missing from the standard installation, the function pointer is initialized to NULL. When the service attempts to execute the function at address 0, it triggers an access violation and crashes the process. This can be triggered by a remote, unauthenticated attacker via a simple GET request to the affected endpoints on TCP port 7878.
Affected products
- Gladinet Triofox Server Agent 17.1.10488.57063
Timeline
- 2026-05-27: advisory: Tenable published research advisory TRA-2026-45
- 2026-05-27: disclosed: CVE-2026-8359 published to the NVD dataset