PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10880 Osnexus CVE debrief

CVE-2026-10880 is a critical SQL injection vulnerability in the OSNexus QuantaStor SDS Manager. The vulnerability exists in the login endpoint, where the username field is not properly sanitized before being incorporated into a SQL query. This allows an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a valid password. The vulnerability has a CVSS score of 9.8 and is considered CRITICAL.

Vendor
Osnexus
Product
QuantaStor
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Administrators and users of OSNexus QuantaStor SDS Manager should be aware of this vulnerability and take immediate action to mitigate it.

Technical summary

The vulnerability is caused by improper sanitization of the username field in the login endpoint, allowing SQL injection attacks. An attacker can exploit this vulnerability to bypass authentication and gain administrative access to the system.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the patch or update provided by the vendor as soon as possible.
  • Restrict access to the login endpoint to trusted IP addresses or networks.
  • Monitor system logs for suspicious activity.

Evidence notes

The vulnerability was reported by Blacklanternsecurity and is tracked under CVE-2026-10880.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10880 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10880

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10880 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10880

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.