CVE-2026-10880 is a critical SQL injection vulnerability (CWE-89) affecting OSNexus QuantaStor SDS Manager version 5.9. The flaw exists because the username field in the login endpoint is improperly sanitized before being included in a SQL query. This allows an unauthenticated remote attacker to bypass authentication controls and log in as an administrator without supplying valid credentials. The vulnerability has a CVSS v3.1 base score of 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to bypass authentication and gain administrative access to the affected system. This compromises confidentiality, integrity, and availability of the system and its data. Given the administrative access gained, the attacker could potentially control the system fully.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the login endpoint to trusted networks if possible and monitor for suspicious activity. Avoid exposing the vulnerable service to untrusted networks.