What’s Vulnerable › Vulnerabilities

CVE-2026-50040: Cross-site Scripting in StoneFly Storage Concentrator

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-30 · updated 2026-07-01
• Weakness: CWE-79

Description

Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser session in the context of the application. This could be leveraged to steal session cookies, redirect users, or perform unauthorized actions on behalf of the victim.

Affected products

• StoneFly Storage Concentrator: before 8.0.4.22 — fixed in 8.0.4.22
• StoneFly Storage Concentrator Virtual Machine: before 8.0.4.22 — fixed in 8.0.4.22

How to fix

Upgrade to a fixed version: StoneFly Storage Concentrator 8.0.4.22; StoneFly Storage Concentrator Virtual Machine 8.0.4.22. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json
• https://stonefly.com/contact-us/
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06

Get alerted when CVE-2026-50040 or the next vulnerability affects your stack