CVE-2026-10880CWE-89

Unauthenticated SQL Injection in Osnexus Quantastor

Critical · published June 4, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a valid password.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-06-04T17:19Z
EPSS history
Timeline
  • 04 JUN 17:19Z
    Unauthenticated SQL Injection in Osnexus Quantastor
    cvelistv5