Reflected XSS in Storage Concentrator SC & SCVM

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: ICS-CERT

Description

Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser session in the context of the application. This could be leveraged to steal session cookies, redirect users, or perform unauthorized actions on behalf of the victim.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-50040

EUVD

EUVD-2026-40458

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The vulnerability in Storage Concentrator (SC & SCVM) is a reflected cross-site scripting (XSS) issue. It occurs because unsanitized content is echoed back in 404 error pages. An attacker can create a malicious URL that, when visited by an authenticated user, causes arbitrary scripts to run within the user's browser session in the context of the application.

Impact Analysis

This vulnerability can be exploited to steal session cookies, redirect users to malicious sites, or perform unauthorized actions on behalf of the victim user. Essentially, it allows attackers to hijack user sessions or manipulate user interactions within the application.

Hi! I’m here to help you understand CVE-2026-50040. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70