CVE-2026-55721 describes an SQL injection vulnerability in StoneFly Storage Concentrator's login.pl and debug.pl scripts. The issue is caused by improper neutralization of special elements in cookie values incorporated directly into SQL queries. This flaw enables unauthenticated remote attackers to manipulate database queries to extract sensitive information including session tokens, password hashes, and secret keys. The vulnerability has a CVSS 4.0 score of 9.2 (critical) with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and system components. No vendor advisory or patch information is currently available.

An unauthenticated remote attacker can exploit this SQL injection vulnerability to access sensitive information stored in the backend database, including session tokens, password hashes, and secret keys. This can lead to unauthorized access, credential compromise, and potential further system compromise. The vulnerability affects confidentiality and system integrity with high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected scripts if possible and monitor for suspicious activity related to login.pl and debug.pl. Avoid exposing these scripts to untrusted networks. Follow vendor updates closely for an official fix.