External risk intelligence

OSNexus QuantaStor SDS Manager SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-10880

The vulnerability exists in the login endpoint of a storage management appliance. Such management interfaces are commonly exposed to the network to facilitate administrative access, and as an unauthenticated gateway service, it is intended to be accessible for user authentication.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability allows attackers to bypass login controls and gain administrator access to OSNexus QuantaStor SDS Manager. The issue stems from a weakness in how the system handles user input for login, meaning unauthorized individuals could potentially access sensitive storage management functions without proper credentials. The main concern is confirming relevance and exposure.

Attackers can bypass login for administrative access.
Critical storage management functions could be compromised.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker can target the OSNexus QuantaStor SDS Manager's login endpoint by sending a specially crafted username. This input is not properly cleaned, allowing the attacker to inject malicious SQL commands. If successful, this bypasses the need for a valid password and grants administrative access, potentially allowing the attacker to control the storage system.

No authentication required.
Malicious input in username field.
Unauthorized administrative access.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could exploit a SQL injection vulnerability in the OSNexus QuantaStor SDS Manager's login endpoint. This could allow them to bypass authentication and gain administrator access without a valid password when the system's login endpoint is exposed to the network.

Administrative access to the SDS Manager.
SQL injection via unsanitized username field.
Unauthorized administrator control.

Operational Fix

Recommended remediation, mitigation, and detection steps

OSNexus QuantaStor SDS Manager's SQL injection vulnerability in the login endpoint requires swift action from infrastructure and security teams. The first practical step is to identify all instances of QuantaStor SDS Manager within your environment, determine their network exposure and business criticality, and then locate the accountable system owner. Remediation planning should be risk-based, potentially involving vendor coordination or temporary mitigation if immediate patching is not feasible.

Infrastructure and security teams own remediation.
Verify QuantaStor SDS Manager network exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OSNexus QuantaStor SDS Manager?

OSNexus QuantaStor is a software-defined storage (SDS) platform used to manage and scale enterprise storage systems. Its SDS Manager component acts as the centralized web-based administrative console. IT administrators rely on this interface to configure storage pools, manage filesystems, and oversee data protection policies across their storage infrastructure.

How does CVE-2026-10880 create a security risk?

This vulnerability is classified as a SQL injection (CWE-89). It occurs when the software fails to properly sanitize the username field in the login screen before processing it in a database query. By injecting malicious SQL commands into this field, an attacker can manipulate the query logic to trick the system into believing they have provided valid credentials, effectively bypassing the authentication process entirely.

Do I need a password to trigger this vulnerability?

No. A key characteristic of this flaw is that it is unauthenticated, meaning an attacker does not need a valid password or prior access to the system. The vulnerability is triggered by sending a specially crafted username string directly to the login endpoint. Normal interaction with the login page that uses legitimate credentials does not trigger this issue.

Is my storage system at risk of this SQL injection?

Systems are most at risk if the SDS Manager login page is reachable over the network. According to Halo Surface Signal, this vulnerability is particularly relevant because management interfaces are often placed on network segments intended for administrative access. If your management console is accessible to remote users or exists on a broader network, it is a primary candidate for inspection.

What should I do if I run QuantaStor SDS Manager?

Begin by creating an inventory of all QuantaStor instances in your environment to understand their network reachability. Once identified, locate the specific teams responsible for these systems to discuss risk. Prioritize evaluating the network exposure of these consoles and coordinate with the vendor to obtain the necessary updates or guidance to secure the login endpoint against unauthorized access.

References

blog.blacklanternsecurity.com/p/cve-2026-10880-osnexus-quantastor

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.