CVE-2026-55721: SQL Injection in StoneFly Storage Concentrator

Published Jun 30, 2026

Updated

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.

Affected Software

1 affected component

StoneFly Storage Concentrator

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade StoneFly Storage Concentrator (SC & SCVM) to a version that resolves this vulnerability.
Fixed in 8.0.4.29

Event History

Jun 30, 2026

CVE Published

via MITRE·10:36 PM

Data Sourced

via MITRE·10:36 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-55721?

CVE-2026-55721 has a critical severity rating of 9.3.

How does CVE-2026-55721 affect StoneFly Storage Concentrator?

CVE-2026-55721 allows an unauthenticated remote attacker to perform SQL injection attacks through unvalidated cookie values.

What are the potential impacts of CVE-2026-55721?

An attacker exploiting CVE-2026-55721 may gain unauthorized access to sensitive data or manipulate database queries.

How do I fix CVE-2026-55721?

To fix CVE-2026-55721, ensure proper input validation and sanitation of cookie values in the affected scripts.

Is CVE-2026-55721 exploitable without authentication?

Yes, CVE-2026-55721 can be exploited by an unauthenticated remote attacker.