CVE-2026-54366 is an XXE vulnerability in CentreStack's storage configuration handler—an unauthenticated XML parsing endpoint that can be leveraged to read sensitive files including Web.config. The CVSS of 7.5 and EPSS score of 0.00287 create a misleading picture of moderate risk. Do not be misled. CentreStack is enterprise collaboration software with a small but high-value operator base. An attacker who knows they're targeting a CentreStack instance has a precise weapon, and the low EPSS likely reflects that automated scanning hasn't prioritized this niche target—not that exploitation is impractical.
The critical lesson here isn't that XXE exists. You already know XXE is dangerous. The instructive failure is the chain of individually defensible decisions that converged to create this exposure: someone needed to parse XML for SharePoint storage configuration, the endpoint was made publicly accessible (likely for initial setup or partner integration), and the XML parser was not hardened against external entity expansion. None of these likely triggered alarm in isolation—a developer adding storage configuration doesn't think they're building an unauthenticated file read primitive.
What you should do: Treat any unauthenticated XML parsing endpoint as a critical finding regardless of its intended scope. The 'internal-only' classification only holds if the network boundary is absolute, and in modern collaboration platforms with partner integrations and multi-tenant architectures, that assumption rots. Audit your configuration handlers for XML parsing and verify they are either behind authentication or have XXE mitigations (disabling external entities, using secure parsers). Given CentreStack's function as a file sync and collaboration platform, the blast radius of a successful exploit could include credential material, keys, and tenant data that the storage configuration handler touches. Patch to version 17.4 or later immediately—if you are running an older version, assume compromise.