Read the docs
TI-2026-36861 Aliases CVE-2026-50040GHSA-8h25-3425-5fgh

Cross-site Scripting in StoneFly Storage Concentrator

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser session in the context of the application. This could be leveraged to steal session cookies, redirect users, or perform unauthorized actions on behalf of the victim.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00327 25th percentileScored 2026-11-07
Fix Fixed Storage Concentrator (StoneFly): 8.0.4.22, 8.0.4.29Storage Concentrator Virtual Machine (StoneFly): 8.0.4.22, 8.0.4.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
StoneFlyStorage Concentratorbefore 8.0.4.228.0.4.22, 8.0.4.29Patch availableCNA
StoneFlyStorage Concentrator Virtual Machinebefore 8.0.4.228.0.4.22, 8.0.4.29Patch availableCNA
  • Storage Concentrator VendorStoneFly Affected before 8.0.4.22 Fixed in 8.0.4.22, 8.0.4.29 Patch available CNA
  • Storage Concentrator Virtual Machine VendorStoneFly Affected before 8.0.4.22 Fixed in 8.0.4.22, 8.0.4.29 Patch available CNA

Remediation

  • Fix · CNA Storage Concentrator (StoneFly) Fixed in 8.0.4.22, 8.0.4.29
  • Fix · CNA Storage Concentrator Virtual Machine (StoneFly) Fixed in 8.0.4.22, 8.0.4.29

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    StoneFly Storage Concentrator, Storage Concentrator Virtual Machine 8.0.4.22

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-40773 OS Command Injection in StoneFly Storage ConcentratorPriority MEDIUM 56
    • TI-2026-40222 SQL Injection in StoneFly Storage ConcentratorPriority MEDIUM 46
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50040
  2. 2026-10-03 Alias added: GHSA-8h25-3425-5fgh

References

Other 3

  • TI-2026-40773 OS Command Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 10.0
  • TI-2026-40771 OS Command Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 10.0
  • TI-2026-40222 SQL Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 9.2
  • TI-2026-36893 Use of Hard-coded Credentials in StoneFly Storage Concentrator CVSS 4.0CRITICAL 9.3
  • TI-2024-21049 StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences