Which versions of Storage Concentrator are affected by EUVD-2026-40845?

StoneFly Storage Concentrator devices can be remotely compromised without authentication by any attacker with network access, potentially leading to data loss, ransomware deployment, or theft of…. A patch is available.

How to fix or mitigate EUVD-2026-40845?

Within 24 hours: Immediately isolate all StoneFly SC and SCVM appliances from untrusted networks; block TCP 9000 access via firewall rules to permit only trusted administrative networks. Within 7 days: Complete inventory of all StoneFly deployments and verify network segmentation; document which systems remain exposed. Within 30 days: Obtain patch availability timeline from StoneFly vendor; evaluate long-term remediation strategy including potential appliance replacement or storage solution migration if patches are indefinitely delayed.

Storage Concentrator EUVD-2026-40845

Q: What is the CVSS score of EUVD-2026-40845?

EUVD-2026-40845 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 3.1%.

| CVE-2026-56413 CRITICAL

OS Command Injection (CWE-78)

2026-06-30 ics-cert@hq.dhs.gov

GHSA-h267-8j5j-27gj

Command Injection

10.0

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote default-listening service with no auth or interaction gives AV:N/AC:L/PR:N/UI:N; root command execution yields full C:H/I:H/A:H, scope unchanged as impact stays on the appliance OS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:31 vuln.today

DescriptionCVE.org

Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.

AnalysisAI

Unauthenticated remote code execution in StoneFly Storage Concentrator (SC) and its virtual appliance variant (SCVM) lets attackers run arbitrary commands as root by sending a crafted packet to the ms_service.pl listener on TCP port 9000. The flaw was reported through CISA ICS-CERT (advisory ICSA-26-181-06) and carries the maximum CVSS 4.0 base score of 10.0; no public exploit has been identified at time of analysis, but the combination of network reachability, zero authentication, and root-level impact makes this a top-priority issue for any exposed device.

Technical ContextAI

Storage Concentrator is StoneFly's iSCSI/storage management appliance (and SCVM, its virtual-machine form factor) used in OT/storage environments. The vulnerable component, ms_service.pl, is a Perl service that binds TCP/9000 by default and parses custom network packets to drive device actions. The root cause is CWE-78 (OS Command Injection): attacker-controlled data from the packet payload is passed into a shell/command context without adequate sanitization, so injected shell metacharacters or commands are executed by the underlying OS. Because the Perl service runs with root privileges, any injected command inherits full administrative control of the appliance.

RemediationAI

No vendor-released patch version was identified in the available data; refer to CISA ICS advisory ICSA-26-181-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06) and the CSAF JSON (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json) for the official fixed release and contact StoneFly (https://stonefly.com/contact-us/) to obtain it. Until a patch is applied, the most effective compensating control is to block or firewall inbound access to TCP port 9000 and restrict it to a dedicated management VLAN or trusted administrative hosts only - this prevents reachability of the ms_service.pl listener but will break any legitimate remote tooling that drives device actions over that port. Remove the appliance from any internet-facing exposure, place it behind a VPN for remote management, and monitor TCP/9000 for anomalous packets as a detection control. Avoid disabling ms_service.pl outright unless the vendor confirms it is non-essential, as it handles core device actions.