Is CVE-2026-55721 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55721 being exploited in the wild.

How severe is CVE-2026-55721?

Critical severity, with a CVSS score of 9.3, published 30 June 2026.

Which products and versions are affected?

StoneFly Storage Concentrator < 8.0.4.22; StoneFly Storage Concentrator Virtual Machine < 8.0.4.22.

Is there a fix for CVE-2026-55721?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-55721 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55721?

Check whether you run StoneFly Storage Concentrator or StoneFly Storage Concentrator Virtual Machine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55721: StoneFly Storage Concentrator SQL injection in login and debug scripts

Q: Is there a fix for CVE-2026-55721?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-55721 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55721?

Check whether you run StoneFly Storage Concentrator or StoneFly Storage Concentrator Virtual Machine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55721 · Severity: critical · CVSS 9.3 · Published 2026-06-30

StoneFly Storage Concentrator, a solution used for managing enterprise data storage, is vulnerable to a security flaw that allows unauthorized individuals to access its internal database. By sending specially crafted web requests, an attacker can steal sensitive information such as login credentials, session tokens, and secret keys. This could lead to a full compromise of the storage management system and the data it protects.

Technologies: StoneFly Storage Concentrator, StoneFly Storage Concentrator Virtual Machine. Vendors: StoneFly.

Quick answers

Is CVE-2026-55721 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55721 being exploited in the wild.
How severe is CVE-2026-55721?: Critical severity, with a CVSS score of 9.3, published 30 June 2026.
Which products and versions are affected?: StoneFly Storage Concentrator < 8.0.4.22; StoneFly Storage Concentrator Virtual Machine < 8.0.4.22.
Is there a fix for CVE-2026-55721?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-55721 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55721?: Check whether you run StoneFly Storage Concentrator or StoneFly Storage Concentrator Virtual Machine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in StoneFly Storage Concentrator (SC) and Storage Concentrator Virtual Machine (SCVM) within the 'login.pl' and 'debug.pl' scripts. The vulnerability is caused by the direct incorporation of HTTP cookie values into database queries without sufficient sanitization. An unauthenticated remote attacker can exploit this by providing malicious SQL commands within a cookie, enabling the extraction of sensitive data including session tokens, password hashes, and secret keys. The issue is addressed in version 8.0.4.29 and later.

Affected products

StoneFly Storage Concentrator < 8.0.4.22
StoneFly Storage Concentrator Virtual Machine < 8.0.4.22

Timeline

2026-06-30: advisory: CISA ICSA-26-181-06 published
2026-06-30: disclosed: CVE-2026-55721 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.