# CVE-2026-50040: StoneFly Storage Concentrator reflected XSS in 404 error pages

Source: https://junglewise.ai/threats/cve-2026-50040-stonefly-storage-concentrator-reflected-xss-in-404-error-pages  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-50040 · Severity: medium · CVSS 6.1 · Published 2026-06-30

StoneFly Storage Concentrator, a solution used for managing enterprise data storage, is vulnerable to a security flaw where it fails to properly clean information displayed on error pages. An attacker could trick a legitimate user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of login sessions, unauthorized data access, or the performance of actions on the user's behalf within the storage management system.

Technologies: [StoneFly Storage Concentrator](https://junglewise.ai/threats/technologies/storage-concentrator), [StoneFly Storage Concentrator Virtual Machine](https://junglewise.ai/threats/technologies/storage-concentrator-virtual-machine). Vendors: [StoneFly](https://junglewise.ai/threats/vendors/stonefly).

## Quick answers

**Is CVE-2026-50040 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50040 being exploited in the wild.

**How severe is CVE-2026-50040?** Medium severity, with a CVSS score of 6.1, published 30 June 2026.

**Which products and versions are affected?** StoneFly Storage Concentrator < 8.0.4.22; StoneFly Storage Concentrator Virtual Machine < 8.0.4.22.

**Is there a fix for CVE-2026-50040?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50040 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50040?** Check whether you run StoneFly Storage Concentrator or StoneFly Storage Concentrator Virtual Machine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in StoneFly Storage Concentrator (SC) and Storage Concentrator Virtual Machine (SCVM) prior to version 8.0.4.22. The vulnerability is located in the handling of 404 error pages, where the application echoes back unsanitized user-supplied content from the URL. An unauthenticated remote attacker can exploit this by crafting a malicious URL and enticing an authenticated user to visit it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session cookie theft or unauthorized application actions. StoneFly recommends upgrading to version 8.0.4.29 or later to remediate this and other related vulnerabilities.

## Affected products

- StoneFly Storage Concentrator < 8.0.4.22
- StoneFly Storage Concentrator Virtual Machine < 8.0.4.22

## Timeline

- 2026-06-30: advisory: CISA and NVD published the advisory.
- 2026-06-30: disclosed

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-181-06.json)
- [https://stonefly.com/contact-us/](https://stonefly.com/contact-us/)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06](https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06)

## Related threats

- [StoneFly Storage Concentrator command injection in debug.pl](https://junglewise.ai/threats/cve-2026-56415-stonefly-storage-concentrator-command-injection-in-debug-pl)
- [StoneFly Storage Concentrator command injection in ms_service.pl](https://junglewise.ai/threats/cve-2026-56413-stonefly-storage-concentrator-command-injection-in-ms-service-pl)
- [StoneFly Storage Concentrator SQL injection in login and debug scripts](https://junglewise.ai/threats/cve-2026-55721-stonefly-storage-concentrator-sql-injection-in-login-and-debug)
- [StoneFly Storage Concentrator hardcoded credentials in configuration file](https://junglewise.ai/threats/cve-2026-50110-stonefly-storage-concentrator-hardcoded-credentials-in)