CVE-2026-50040 describes a reflected cross-site scripting vulnerability (CWE-79) in StoneFly Storage Concentrator (SC & SCVM). The issue arises because unsanitized user input is reflected in 404 error pages, enabling attackers to inject and execute arbitrary scripts in the victim's browser when they visit a crafted URL. This can lead to session hijacking, user redirection, or unauthorized actions within the application context. The vulnerability requires user interaction (UI:A) and has a medium impact on confidentiality and integrity (VC:L, VI:L). No vendor advisory or patch information is currently available.

Successful exploitation allows arbitrary script execution in the context of an authenticated user's session, potentially leading to theft of session cookies, user redirection, and unauthorized actions performed on behalf of the victim. The vulnerability impacts confidentiality and integrity at a low level. There is no indication of privilege escalation or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when clicking on untrusted links that may trigger 404 error pages in the affected product. No official mitigation or workaround has been provided by the vendor at this time.