StoneFly Storage Concentrator Multiple Vulnerabilities (Hardcoded Creds/OS Cmd Injection) and CISA Advisory

Vulnerability Overview Multiple security vulnerabilities exist in StoneFly Storage Concentrator, potentially allowing attackers to gain broad unauthorized access, execute arbitrary commands (with root privileges), steal sensitive data, and perform actions on behalf of legitimate users. Affected Versions Affected versions include: Storage Concentrator <8.0.4.22 (CVE-2026-56415, CVE-2026-55721, CVE-2026-50040) Storage Concentrator Virtual Machine <8.0.4.22 (CVE-2026-56415, CVE-2026-55721, CVE-2026-50040) Storage Concentrator <8.0.4.26 (CVE-2026-50110) Storage Concentrator Virtual Machine <8.0.4.26 (CVE-2026-50110) Storage Concentrator <8.0.4.29 (CVE-2026-56413) Storage Concentrator Virtual Machine <8.0.4.29 (CVE-2026-56413) Remediation CISA recommends that users take defensive measures to minimize the risk of these vulnerabilities being exploited: Minimize the network exposure of all control system devices and/or systems, ensuring they are not accessible from the internet. Place control system networks and remote devices behind firewalls and isolate them from the business network. Use more secure remote access methods, such as Virtual Private Networks (VPNs), when remote access is required, and recognize that VPNs may have vulnerabilities; ensure they are updated to the latest version. Conduct appropriate impact analysis and risk assessment before deploying defensive measures. Implement recommended cybersecurity strategies to proactively defend ICS assets. Follow internal procedures to report suspicious malicious activity and adhere to CISA’s tracking and correlation procedures. Do not click links in unsolicited email messages or open attachments. Refer to CISA-provided information related to email fraud and social engineering attacks. Vulnerability Details CVE-2026-50110: Hardcoded credentials, OS command injection, SQL injection, Cross-Site Scripting (XSS). CVE-2026-56413: Hardcoded credentials, OS command injection, SQL injection, Cross-Site Scripting (XSS). CVE-2026-56415: Hardcoded credentials, OS command injection, SQL injection, Cross-Site Scripting (XSS). CVE-2026-55721: Hardcoded credentials, OS command injection, SQL injection, Cross-Site Scripting (XSS). CVE-2026-50040: Hardcoded credentials, OS command injection, SQL injection, Cross-Site Scripting (XSS). Acknowledgments David Yesland of Rhino Security Labs reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is subject to this notice and the privacy and usage policies. Revision History Initial Release Date: 2026-06-30 Revision: 1 Summary: Initial release Tags Industries: Defense Industrial Base, Energy, Financial Services, Healthcare and Public Health, Information Technology Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Related Advisories Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M Schneider Electric EasyLogic T150 and Saitel DP RTU Frangoteam FUXA SCADA/HMI Schneider Electric EcoStruxure IT Data Center Expert Feedback We have recently updated our anonymous product survey and welcome your feedback. Footer CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov Social Media: Facebook, X, LinkedIn, YouTube, Instagram, RSS Links: About CISA, Budget and Performance, DHS.gov, FOIA Requests, No FEAR Act, Office of Inspector General, Privacy Policy, Subscribe, The White House, USA.gov, Website Feedback Summary Multiple critical security vulnerabilities exist in StoneFly Storage Concentrator, affecting various versions. CISA recommends adopting multiple defensive measures, including minimizing network exposure, using secure remote access methods, conducting risk assessments, and implementing recommended cybersecurity strategies. Relevant vulnerability details and remediation advice are detailed in this advisory.

Goal Reached Thanks to every supporter — we hit 100%!

StoneFly Storage Concentrator Multiple Vulnerabilities (Hardcoded Creds/OS Cmd Injection) and CISA Advisory