CVE-2026-56415 OS Command Injection in StoneFly Storage Concentrator
Remote attackers can execute arbitrary commands with root privileges via unauthenticated HTTP requests to the debug script in StoneFly Storage Concentrator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56415?
CVE-2026-56415 is a critical command injection vulnerability in Stonefly Storage Concentrator, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization, resulting in arbitrary command execution with root-level privileges on the underlying system.
Weakness: CWE-78
Which versions are affected by CVE-2026-56415?
How do I fix CVE-2026-56415?
No fix has been published for CVE-2026-56415 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-56415 being exploited?
There is no known exploitation of CVE-2026-56415 in the wild and no public exploit code.
Sources
Also known as GHSA-p9rg-4wjx-jm87.