Vulnerabilities

TI-2026-40773 CVE-2026-56415 · GHSA-p9rg-4wjx-jm87

OS Command Injection in StoneFly Storage Concentrator

MEDIUM 56

Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.0436 Published 2026-06-30 Fixed in 8.0.4.22, 8.0.4.29 CWE-78

TI-2026-40222 CVE-2026-55721 · GHSA-864f-9wr6-7qwp

MEDIUM 46

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00546 Published 2026-06-30 Fixed in 8.0.4.22, 8.0.4.29 CWE-89

TI-2026-36861 CVE-2026-50040 · GHSA-8h25-3425-5fgh

LOW 23

Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00327 Published 2026-06-30 Fixed in 8.0.4.22, 8.0.4.29 CWE-79