CVE-2026-50110 identifies a critical vulnerability in StoneFly Storage Concentrator (SC & SCVM) where hardcoded credentials for numerous internal services are embedded in a configuration file. Although the credentials are stored in an encoded format, the encoding is reversible, exposing plaintext credentials. These credentials cover a wide range of internal services including database accounts, licensing, replication, and third-party integrations. Exploiting this vulnerability could grant an attacker unauthorized access to multiple interconnected systems within the Storage Concentrator environment. The vulnerability has a CVSS 4.0 base score of 9.3, indicating high impact and exploitability with low attack complexity and no required privileges or user interaction. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could lead to unauthorized access to multiple internal services of the StoneFly Storage Concentrator, including databases, licensing, replication, and third-party integrations. This could compromise confidentiality, integrity, and availability of the affected systems and data. The broad scope of affected internal services increases the potential impact within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to configuration files containing encoded credentials and monitor for unauthorized access attempts. Avoid deploying affected versions in untrusted environments and consider compensating controls such as network segmentation and credential rotation where possible.