CVE-2026-10880— Unauthenticated SQL Injection in Osnexus Quantastor
Quick assessment
Affected
Osnexus QuantaStor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OSNexus QuantaStor SDS Manager是美国OSNexus公司的一个软件定义存储管理平台。 OSNexus QuantaStor SDS Manager存在安全漏洞，该漏洞源于登录端点中用户名字段未正确清理，导致未经验证的远程攻击者通过SQL注入绕过身份验证并以管理员身份登录。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Osnexus | QuantaStor | 5.9< 6.6.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10880
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated SQL Injection in Osnexus Quantastor
Source: CVE Program / CVE List V5
Vulnerability Description
OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a valid password.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
OSNexus QuantaStor SDS Manager 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OSNexus QuantaStor SDS Manager是美国OSNexus公司的一个软件定义存储管理平台。 OSNexus QuantaStor SDS Manager存在安全漏洞，该漏洞源于登录端点中用户名字段未正确清理，导致未经验证的远程攻击者通过SQL注入绕过身份验证并以管理员身份登录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Osnexus | QuantaStor | 5.9 ~ 6.6.1 | - |
|
II. Public POCs for CVE-2026-10880
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10880
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-10880 (1)
IV. Related Vulnerabilities
Same product: QuantaStor
-
CVE-2026-18265
OSNEXUS QuantaStor Missing Authentication Remote Code Execut -
CVE-2021-4406
Authenticated Remote COmmand Execution as root in OSNEXUS Qu -
CVE-2021-42081
Authenticated Remote Command Execution vulnerability in OSNE -
CVE-2021-42083
Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335 -
CVE-2021-42082
Local Privilege Escalation to root in OSNEXUS QuantaStor bef
Same vendor: Osnexus
-
CVE-2026-18265
OSNEXUS QuantaStor Missing Authentication Remote Code Execut -
CVE-2021-4406
Authenticated Remote COmmand Execution as root in OSNEXUS Qu -
CVE-2021-42081
Authenticated Remote Command Execution vulnerability in OSNE -
CVE-2021-42083
Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335 -
CVE-2021-42082
Local Privilege Escalation to root in OSNEXUS QuantaStor bef
Same weakness: CWE-89
-
CVE-2026-107752
Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL I -
CVE-2026-55796
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Rep -
CVE-2026-111718
AipexBase through commit 690adb9 SQL Injection via /api/data -
CVE-2026-111700
WebVella ERP through 1.8.8 SQL Injection via EQL Query API -
CVE-2026-111686
IceCMS through 4.1.5 SQL Injection via /WebArticle/findartic
V. Comments for CVE-2026-10880
No comments yet