What is CVE-2026-55721?

CVE-2026-55721 is a critical-severity vulnerability in Stonefly Storage Concentrator, classified under SQL Injection. CVSS score: 9.3/10. Published 2026-06-30.

How severe is CVE-2026-55721?

Critical severity. CVSS v3 base score is 9.3 out of 10.

SQL Injection in Stonefly Storage Concentrator

CVE-2026-55721

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.

Vulnerability class: SQL Injection

EPSS: 0.004 (36.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N.

Affected products

Stonefly Storage Concentrator — versions 0, 8.0.4.29
Stonefly Storage Concentrator Virtual Machine — versions 0, 8.0.4.29

Weakness classification (CWE)

CWE-89 — SQL Injection

References

Frequently asked questions

What is CVE-2026-55721?: CVE-2026-55721 is a critical-severity vulnerability in Stonefly Storage Concentrator, classified under SQL Injection. CVSS score: 9.3/10. Published 2026-06-30.
How severe is CVE-2026-55721?: Critical severity. CVSS v3 base score is 9.3 out of 10.