CVE-2026-56413: OS Command Injection in StoneFly Storage Concentrator

Published Jun 30, 2026

Updated

Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the msservice.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.

Affected Software

1 affected component

Storage Concentrator (SC & SCVM)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade StoneFly Storage Concentrator (SC & SCVM) to a version that resolves this vulnerability.
Fixed in 8.0.4.29

Event History

Jun 30, 2026

CVE Published

via MITRE·10:50 PM

Data Sourced

via MITRE·10:50 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-56413?

The severity of CVE-2026-56413 is rated as critical with a CVSS score of 10.

How do I fix CVE-2026-56413?

To fix CVE-2026-56413, it is recommended to apply the latest patches from StoneFly for the Storage Concentrator software.

What impact does CVE-2026-56413 have on my system?

CVE-2026-56413 allows unauthenticated remote attackers to execute arbitrary commands on the affected Storage Concentrator system.

Which software is affected by CVE-2026-56413?

CVE-2026-56413 affects the Storage Concentrator (SC) and Storage Concentrator Virtual Machine (SCVM) software.

How can an attacker exploit CVE-2026-56413?

An attacker can exploit CVE-2026-56413 by sending specially crafted packets to the ms_service.pl service listening on TCP port 9000.