Critical RCE Vulnerability in Quantum StorNext Web GUI API (CVE-2025-46616)

A critical vulnerability (CVE-2025-46616) has been identified in Quantum StorNext Web GUI API versions prior to 7.2.4, allowing remote code execution (RCE) through malicious file uploads. The flaw affects multiple Quantum storage products, including StorNext RYO, StorNext Xcellis Workflow Director, and ActiveScale Cold Storage, with a CVSS 3.1 score of 9.9 (Critical).

Technical Overview

The vulnerability stems from improper file upload validation in the Web GUI API (CWE-434), enabling authenticated attackers to execute arbitrary code on affected systems. The attack vector is network-based, requiring low-privilege access (AV:N/AC:L/PR:L). Successful exploitation could lead to complete system compromise, including data theft, service disruption, or lateral movement within enterprise storage environments.

Quantum has confirmed the vulnerability impacts all versions before 7.2.4 across their product line. The StorNext Web GUI API is a common component in Quantum’s enterprise storage solutions, making this a widespread concern for organizations using these systems for high-performance data management.

Affected Products and Mitigation

The following Quantum products are confirmed vulnerable:

Product	Vulnerable Versions	Fixed Version
StorNext Web GUI API	< 7.2.4	7.2.4+
StorNext RYO	< 7.2.4	7.2.4+
StorNext Xcellis Workflow Director	< 7.2.4	7.2.4+
ActiveScale Cold Storage	All versions	Pending update

Quantum has released patches for most affected products, available through their official support channels. For systems that cannot be immediately updated, the following workarounds are recommended:

Restrict API access to trusted networks only
Implement strict file type validation for uploads
Monitor API logs for unusual upload activity
Segment storage networks from critical infrastructure

Detection and Response

Organizations should immediately inventory all Quantum storage systems and verify versions. The following indicators may suggest exploitation attempts:

– Unusual file uploads to the Web GUI API endpoint
– Unexpected processes spawned by the StorNext service
– Modifications to system files or configurations
– Network connections from storage systems to unexpected destinations

Security teams should prioritize reviewing logs from affected systems, particularly focusing on file upload activities through the API interface. Quantum has provided additional detection guidance in their security bulletin.

Conclusion

CVE-2025-46616 represents a significant risk to organizations using Quantum’s storage solutions due to the potential for complete system compromise. The critical nature of these systems in enterprise environments amplifies the impact, as they often contain sensitive data and support critical business operations.

While no public exploits have been reported as of April 25, 2025, the simplicity of the attack vector makes this vulnerability particularly dangerous. Organizations should treat this as a high-priority remediation item and apply patches immediately or implement the recommended workarounds.