CVE-2026-56415

CriticalCVSS 10.0/10Last modified Jul 1, 2026

Description

Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization, resulting in arbitrary command execution with root-level privileges on the underlying system.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Stonefly	Storage Concentrator	< 8.0.4.22
Stonefly	Storage Concentrator Virtual Machine	< 8.0.4.22

References

Timeline

Published: Jun 30, 2026
Last modified: Jul 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-564164.8In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINF CVE-2026-56427.3A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknow CVE-2026-564229.4Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/sco CVE-2026-564238.8MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelecti CVE-2026-564248.8MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where owners CVE-2026-564258.8The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could CVE-2026-564288.1The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default con CVE-2026-56432.4A vulnerability was identified in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This impacts an unknow CVE-2026-564328.2Unintended proxy or intermediary ('confused deputy') in the MigTD signing for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0:CVE-2026-564346.5NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side I CVE-2026-564358.7Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allo CVE-2026-564378.4Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the