CVE-2026-50110 CRITICAL

CVE-2026-50110: Use of Hard-coded Credentials in StoneFly Storage Concentrator

Vendor Stonefly
Product Storage Concentrator
Weakness CWE-798 · Hardcoded credentials
Published June 30, 2026
Last update July 1, 2026

CVSS base score

9.3/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

What the vulnerability does

01Description

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems.

Key dates

02Disclosure timeline

June 30, 2026 CVE published
July 1, 2026 Record updated