CVE-2026-50040 describes a reflected cross-site scripting vulnerability in StoneFly Storage Concentrator (SC & SCVM). The issue arises because unsanitized user input is reflected in 404 error pages, enabling attackers to inject and execute arbitrary JavaScript within the victim's browser session. This vulnerability requires user interaction (visiting a crafted URL) and affects authenticated users. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity, with limited scope and no availability impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an authenticated user's browser session. This can result in theft of session cookies, redirection to malicious sites, or unauthorized actions performed on behalf of the victim within the application. The impact is limited to users who visit the malicious URL and are authenticated, with no direct impact on system availability or integrity beyond the user session context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on suspicious links related to the Storage Concentrator interface. Administrators should monitor vendor communications for updates and apply official patches once released.