Vulnerability · Published Jun 30, 2026 · Assigned by icscert

CVE-2026-56413OS Command Injection in StoneFly Storage Concentrator

Critical 10.0

In plain English

A critical-severity OS command injection in Storage Concentrator from StoneFly. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)4.2%top 9.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.

Affected products (as reported)

Vendor	Product	Versions
StoneFly	Storage Concentrator	0 – before 8.0.4.29
StoneFly	Storage Concentrator Virtual Machine	0 – before 8.0.4.29

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References