Vulnerability in Stonefly Storage Concentrator
CVE-2026-50110
Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems.
EPSS: 0.001 (3.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.2 (Critical). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.
Affected products
- Stonefly Storage Concentrator — versions 0, 8.0.4.29
- Stonefly Storage Concentrator Virtual Machine — versions 0, 8.0.4.29
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-50110?
- CVE-2026-50110 is a critical-severity vulnerability in Stonefly Storage Concentrator, classified under Use of Hard-coded Credentials. CVSS score: 9.2/10. Published 2026-06-30.
- How severe is CVE-2026-50110?
- Critical severity. CVSS v3 base score is 9.2 out of 10.