StoneFly Storage Concentrator Multiple Critical Vulnerabilities (Hardcoded Credentials, OS Command Injection, SQL Injection, XSS)
First seen Jul 6, 2026 · Updated Jul 6, 2026 · CVSS 10
StoneFly Storage Concentrator (SC) and its Virtual Machine variant contain five critical/medium vulnerabilities including hardcoded credentials, two unauthenticated OS command injection flaws leading to root-level remote code execution, an unauthenticated SQL injection exposing session tokens and password hashes, and a reflected XSS. Combined, these flaws allow attackers to fully compromise storage infrastructure without authentication, potentially affecting Defense Industrial Base, Energy, Financial Services, Healthcare, and IT sector organizations worldwide.
Technical Analysis
CVE-2026-56413 and CVE-2026-56415 (CVSS 10.0) are unauthenticated OS command injection vulnerabilities in ms_service.pl (TCP port 9000) and debug.pl respectively, allowing remote attackers to execute arbitrary commands with root privileges via crafted network packets or HTTP requests. CVE-2026-55721 (CVSS 9.3) is an unauthenticated SQL injection in login.pl and debug.pl via cookie values, enabling extraction of session tokens, password hashes, and stored secret keys. CVE-2026-50110 (CVSS 9.2) involves hardcoded, reversibly-encoded credentials embedded in a configuration file spanning database accounts, licensing, replication services, and third-party integrations, enabling lateral movement across interconnected systems. CVE-2026-50040 (CVSS 6.1) is a reflected XSS via unsanitized 404 error page content that can be used to steal session cookies. If any AI agent frameworks, RAG pipelines, or orchestration tooling rely on StoneFly Storage Concentrator for backend storage, model artifact repositories, or credential/secrets management, exposed hardcoded credentials and root-level RCE could allow attackers to exfiltrate API keys, model weights, or vector store data and pivot into agent infrastructure — organizations should treat this as agent-relevant if such storage is in their agent stack.
Affected Systems
StoneFly Storage Concentrator versions <8.0.4.22 (CVE-2026-56415, CVE-2026-55721, CVE-2026-50040); <8.0.4.26 (CVE-2026-50110); <8.0.4.29 (CVE-2026-56413); StoneFly Storage Concentrator Virtual Machine, same version ranges affected identically.
Indicators of Compromise
- No known IOCs or public exploitation reported at this time (per CISA advisory)
Remediation Steps
- 1
Upgrade to patched version
Update StoneFly Storage Concentrator and Storage Concentrator Virtual Machine to version 8.0.4.29 or later, which remediates all five vulnerabilities.
- 2
Rotate hardcoded/embedded credentials
After patching, rotate all internal service credentials (database, licensing, replication, third-party integrations) previously stored in the vulnerable configuration file, as they may have been exposed.
- 3
Restrict network exposure
Ensure Storage Concentrator management interfaces and TCP port 9000 (ms_service.pl) are not accessible from the internet; isolate behind firewalls and segment from business networks.
- 4
Use secure remote access
Require VPN access for any remote administration, keeping VPN software patched and treating it as only as secure as connected endpoints.
- 5
Monitor for exploitation
Monitor logs and network traffic for anomalous requests to login.pl, debug.pl, and port 9000, and report suspected malicious activity to CISA.
- 6
Session and credential hygiene
Invalidate active sessions and review for signs of session token or password hash theft resulting from the SQL injection vector.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.