CVE-2026-50110 Use of Hard-coded Credentials in StoneFly Storage Concentrator
Hardcoded credentials in StoneFly Storage Concentrator allow attackers to access internal services and interconnected systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-50110?
CVE-2026-50110 is a critical vulnerability in StoneFly Storage Concentrator, published on 30 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning successful exploitation of this vulnerability could provide an attacker with unauthorized access to multiple interconnected systems.
Weakness: CWE-798
Which versions are affected by CVE-2026-50110?
How do I fix CVE-2026-50110?
No fix has been published for CVE-2026-50110 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-50110 being exploited?
There is no known exploitation of CVE-2026-50110 in the wild and no public exploit code.
Sources
Also known as GHSA-7x9m-9r4j-r94f.