Which versions of Storage Concentrator are affected by CVE-2026-50110?

StoneFly Storage Concentrator (SC and SCVM) contains a critical vulnerability that exposes plaintext credentials for databases, licensing, replication, and third-party integrations stored in…. A patch is available.

How to fix or mitigate CVE-2026-50110?

Within 24 hours: audit and restrict local access (physical console, SSH, RDP) to all StoneFly SC/SCVM instances; review access logs for unauthorized activity; notify teams managing systems that consume StoneFly credentials. Within 7 days: implement restrictive file permissions (mode 600) on StoneFly configuration files; rotate all credentials managed by or integrated with StoneFly instances; conduct credential validation audit across dependent systems. Within 30 days: monitor ICSA-26-181-06 advisory for patch release; evaluate credential management architecture redesign; implement centralized secrets management solution to eliminate reversible encoding of credentials.

Storage Concentrator CVE-2026-50110

Q: What is the CVSS score of CVE-2026-50110?

CVE-2026-50110 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-40846 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-06-30 ics-cert@hq.dhs.gov

GHSA-7x9m-9r4j-r94f

Authentication Bypass

9.3

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.2 CRITICAL

Credentials read locally from a config file (AV:L) with no further auth, and the recovered secrets unlock other back-end systems, justifying S:C with high C/I and low A impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:30 vuln.today

DescriptionCVE.org

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems.

AnalysisAI

Credential exposure in StoneFly Storage Concentrator (SC) and its virtual machine variant (SCVM) lets an attacker recover plaintext credentials for numerous internal services from a configuration file where they are stored using reversible encoding rather than encryption. The hardcoded accounts cover databases, licensing, replication, and third-party integrations, so recovering them grants pivoting access across multiple interconnected systems. Reported to NVD via CISA ICS-CERT (advisory ICSA-26-181-06); no public exploit identified at time of analysis and the vector is local (AV:L).

Technical ContextAI

StoneFly Storage Concentrator is an iSCSI/storage management appliance (physical SC and virtual SCVM) used in OT/ICS and enterprise storage environments. The root cause is CWE-798 (Use of Hard-coded Credentials): static service credentials for back-end components - database accounts, the licensing subsystem, replication services, and third-party integrations - are embedded directly in a configuration file. They are obfuscated with a reversible encoding scheme (not a salted one-way hash or a key-protected secret store), so anyone who can read the config file and apply the known decoding can recover cleartext passwords. Because these are shared, embedded secrets rather than per-deployment generated credentials, the same values likely recur across installations and unlock the appliance's interconnected service mesh.

RemediationAI

No vendor-released patch version is identified in the provided data - review the CISA advisory ICSA-26-181-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06) and contact StoneFly (https://stonefly.com/contact-us/) for the fixed firmware/SCVM release and apply it as the primary fix; if the vendor provides a build that rotates or randomizes the embedded credentials, deploy it and then force-rotate every affected back-end secret (database, licensing, replication, integration accounts), since the original cleartext values must be considered compromised. Until a fix is available, restrict filesystem and management access to the appliance to the smallest possible set of administrators, isolate SC/SCVM on a segmented OT/management VLAN with no exposure to general user or internet networks, and tightly control access to the configuration file and any backups (which contain the same recoverable secrets) - the trade-off is that aggressive network isolation can disrupt replication and third-party integrations that legitimately use these accounts, so validate dependencies before locking them down. Monitor for unexpected use of database/replication/licensing accounts as a detective control.