CVE-2026-55721criticalCWE-89

CVE-2026-55721: critical vulnerability in StoneFly Storage Concentrator

SQL Injection in StoneFly Storage Concentrator

Published · Updated

Follow this CVE+ Monitor Storage Concentrator+ Monitor Storage Concentrator Virtual Machine

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 0.5%
Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Affected products
StoneFly · Storage ConcentratorStoneFly · Storage Concentrator Virtual Machine
Related CVEs — StoneFly Storage Concentrator

In the same product, most dangerous first.

CVE-2026-56413CRITICALOS Command Injection in StoneFly Storage ConcentratorEPSS 4.2%CVE-2026-50040MEDIUMCross-site Scripting in StoneFly Storage ConcentratorEPSS 0.3%CVE-2026-50110CRITICALUse of Hard-coded Credentials in StoneFly Storage ConcentratorEPSS 0.2%