Read the docs
TI-2026-40773 Aliases CVE-2026-56415GHSA-p9rg-4wjx-jm87

OS Command Injection in StoneFly Storage Concentrator

Priority MEDIUM 56CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization, resulting in arbitrary command execution with root-level privileges on the underlying system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0436 91st percentileScored 2026-11-07
Fix Fixed Storage Concentrator (Stonefly): 8.0.4.22, 8.0.4.29Storage Concentrator Virtual Machine (Stonefly): 8.0.4.22, 8.0.4.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
StoneFlyStorage Concentratorbefore 8.0.4.228.0.4.22, 8.0.4.29Patch availableCNA
StoneFlyStorage Concentrator Virtual Machinebefore 8.0.4.228.0.4.22, 8.0.4.29Patch availableCNA
  • Storage Concentrator VendorStoneFly Affected before 8.0.4.22 Fixed in 8.0.4.22, 8.0.4.29 Patch available CNA
  • Storage Concentrator Virtual Machine VendorStoneFly Affected before 8.0.4.22 Fixed in 8.0.4.22, 8.0.4.29 Patch available CNA

Remediation

  • Fix · CNA Storage Concentrator (Stonefly) Fixed in 8.0.4.22, 8.0.4.29
  • Fix · CNA Storage Concentrator Virtual Machine (Stonefly) Fixed in 8.0.4.22, 8.0.4.29

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    StoneFly Storage Concentrator, Storage Concentrator Virtual Machine 8.0.4.22

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-40222 SQL Injection in StoneFly Storage ConcentratorPriority MEDIUM 46
    • TI-2026-36861 Cross-site Scripting in StoneFly Storage ConcentratorPriority LOW 23
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56415
  2. 2026-10-03 Alias added: GHSA-p9rg-4wjx-jm87

References

Other 3

  • TI-2026-40771 OS Command Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 10.0
  • TI-2026-40222 SQL Injection in StoneFly Storage Concentrator CVSS 4.0CRITICAL 9.2
  • TI-2026-36893 Use of Hard-coded Credentials in StoneFly Storage Concentrator CVSS 4.0CRITICAL 9.3
  • TI-2024-21049 StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by… CVSS 3.1MEDIUM 6.5
  • TI-2026-36861 Cross-site Scripting in StoneFly Storage Concentrator CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences