Read the docs
TI-2026-36893 Aliases CVE-2026-50110GHSA-7x9m-9r4j-r94f

Use of Hard-coded Credentials in StoneFly Storage Concentrator

Priority MEDIUM 41CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00175 7th percentileScored 2026-11-07
Fix Fixed Storage Concentrator (StoneFly): 8.0.4.26, 8.0.4.29Storage Concentrator Virtual Machine (StoneFly): 8.0.4.26, 8.0.4.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
StoneFlyStorage Concentratorbefore 8.0.4.268.0.4.26, 8.0.4.29Patch availableCNA
StoneFlyStorage Concentrator Virtual Machinebefore 8.0.4.268.0.4.26, 8.0.4.29Patch availableCNA
  • Storage Concentrator VendorStoneFly Affected before 8.0.4.26 Fixed in 8.0.4.26, 8.0.4.29 Patch available CNA
  • Storage Concentrator Virtual Machine VendorStoneFly Affected before 8.0.4.26 Fixed in 8.0.4.26, 8.0.4.29 Patch available CNA

Remediation

  • Fix · CNA Storage Concentrator (StoneFly) Fixed in 8.0.4.26, 8.0.4.29
  • Fix · CNA Storage Concentrator Virtual Machine (StoneFly) Fixed in 8.0.4.26, 8.0.4.29

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50110
  2. 2026-10-03 Alias added: GHSA-7x9m-9r4j-r94f

References

Other 3

  • TI-2026-40773 OS Command Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 10.0
  • TI-2026-40771 OS Command Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 10.0
  • TI-2026-40222 SQL Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 9.2
  • TI-2024-21049 StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by… CVSS 3.1MEDIUM 6.5
  • TI-2026-36861 Cross-site Scripting in StoneFly Storage Concentrator CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences