Read the docs
TI-2026-40222 Aliases CVE-2026-55721GHSA-864f-9wr6-7qwp

SQL Injection in StoneFly Storage Concentrator

Priority MEDIUM 46CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00546 46th percentileScored 2026-11-07
Fix Fixed Storage Concentrator (StoneFly): 8.0.4.22, 8.0.4.29Storage Concentrator Virtual Machine (StoneFly): 8.0.4.22, 8.0.4.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
StoneFlyStorage Concentratorbefore 8.0.4.228.0.4.22, 8.0.4.29Patch availableCNA
StoneFlyStorage Concentrator Virtual Machinebefore 8.0.4.228.0.4.22, 8.0.4.29Patch availableCNA
  • Storage Concentrator VendorStoneFly Affected before 8.0.4.22 Fixed in 8.0.4.22, 8.0.4.29 Patch available CNA
  • Storage Concentrator Virtual Machine VendorStoneFly Affected before 8.0.4.22 Fixed in 8.0.4.22, 8.0.4.29 Patch available CNA

Remediation

  • Fix · CNA Storage Concentrator (StoneFly) Fixed in 8.0.4.22, 8.0.4.29
  • Fix · CNA Storage Concentrator Virtual Machine (StoneFly) Fixed in 8.0.4.22, 8.0.4.29

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    StoneFly Storage Concentrator, Storage Concentrator Virtual Machine 8.0.4.22

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-40773 OS Command Injection in StoneFly Storage ConcentratorPriority MEDIUM 56
    • TI-2026-36861 Cross-site Scripting in StoneFly Storage ConcentratorPriority LOW 23
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55721
  2. 2026-10-03 Alias added: GHSA-864f-9wr6-7qwp

References

Other 3

  • TI-2026-40773 OS Command Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 10.0
  • TI-2026-40771 OS Command Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 10.0
  • TI-2026-36893 Use of Hard-coded Credentials in StoneFly Storage Concentrator CVSS 4.0CRITICAL 9.3
  • TI-2024-21049 StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by… CVSS 3.1MEDIUM 6.5
  • TI-2026-36861 Cross-site Scripting in StoneFly Storage Concentrator CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences