Which versions of Storage Concentrator are affected by CVE-2026-56415?

StoneFly Storage Concentrator systems are exposed to a critical unauthenticated vulnerability enabling complete remote takeover and data compromise (CVE-2026-56415, CVSS 10.0).. A patch is available.

How to fix or mitigate CVE-2026-56415?

Within 24 hours: Inventory all StoneFly SC and SCVM instances and immediately restrict network access to the debug.pl endpoint (typically port 80/443) using firewall rules or network segmentation; disable public internet exposure to storage systems. Within 7 days: Deploy intrusion detection rules to monitor for suspicious HTTP requests to debug.pl; enable enhanced logging and forward to SIEM; contact StoneFly support for patch availability and interim guidance. Within 30 days: Coordinate with vendor for patch release timeline; apply firmware patch immediately upon availability; conduct forensic analysis of affected systems for compromise indicators; review access logs dating back to vulnerability discovery.

Storage Concentrator CVE-2026-56415

Q: What is the CVSS score of CVE-2026-56415?

CVE-2026-56415 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 3.1%.

EUVD-2026-40844 CRITICAL

OS Command Injection (CWE-78)

2026-06-30 ics-cert@hq.dhs.gov

GHSA-p9rg-4wjx-jm87

Command Injection

10.0

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network request triggers shell injection (AV:N/AC:L/PR:N/UI:N); web-app flaw yields root on the host OS, a scope change (S:C) with full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:32 vuln.today

DescriptionCVE.org

Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization, resulting in arbitrary command execution with root-level privileges on the underlying system.

AnalysisAI

Unauthenticated remote command injection in StoneFly Storage Concentrator (SC) and its virtual appliance variant (SCVM) lets remote attackers run arbitrary OS commands as root by sending a crafted HTTP request to the debug.pl script, which processes attacker input without sanitization. Rated CVSS 4.0 10.0 and reported through CISA ICS-CERT (advisory ICSA-26-181-06); no public exploit identified at time of analysis. This is a complete-compromise primitive requiring no credentials or user interaction.

Technical ContextAI

Storage Concentrator is StoneFly's iSCSI/IP-SAN storage management platform, shipped as both a physical appliance (SC) and a virtual machine image (SCVM) that exposes a Perl-based web management interface. The flaw is classic OS Command Injection (CWE-78): the debug.pl CGI/management script passes externally controlled HTTP parameters into a shell or command context without escaping or allow-listing, so shell metacharacters in the payload are interpreted by the underlying OS. Because the web/management stack runs with root privileges on the appliance, injected commands inherit root, giving full control of the storage controller and the data it serves.

RemediationAI

Apply the StoneFly-provided fix for Storage Concentrator SC and SCVM as published in CISA ICS advisory ICSA-26-181-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06) and the CSAF advisory (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json); an exact patched version was not present in the input data, so confirm the fixed release directly with StoneFly (https://stonefly.com/contact-us/) - do not deploy an assumed version number. Until patched, restrict network reachability of the management interface: place the appliance management plane on an isolated OT/management VLAN, block all external and untrusted access to its web/HTTP management port at the firewall, and allow-list only specific administrative hosts (trade-off: legitimate remote management must traverse a VPN or jump host). If the deployment supports it, specifically block or remove access to the debug.pl endpoint via a reverse proxy or web server rule (trade-off: may break vendor debugging/support workflows). Avoid exposing SC/SCVM management to the internet under any circumstance.