CVE-2026-50040: Cross-site Scripting in StoneFly Storage Concentrator
Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser session in the context of the application. This could be leveraged to steal session cookies, redirect users, or perform unauthorized actions on behalf of the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
StoneFly Storage Concentratorto a version that resolves this vulnerability.Fixed in 8.0.4.29
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50040?
The severity of CVE-2026-50040 is classified as medium with a score of 6.1.
How do I fix CVE-2026-50040?
To mitigate CVE-2026-50040, sanitize and validate user input to prevent reflected cross-site scripting attacks.
What kind of vulnerability is CVE-2026-50040?
CVE-2026-50040 is a cross-site scripting (XSS) vulnerability affecting the StoneFly Storage Concentrator.
What impact does CVE-2026-50040 have on users?
CVE-2026-50040 allows an attacker to execute arbitrary script content in the browser of an authenticated user.
Which software is affected by CVE-2026-50040?
CVE-2026-50040 affects the StoneFly Storage Concentrator and its virtual machine version (SC & SCVM).