Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4547 vulnerabilities by Netapp
CERTFR-2026-AVI-0742
Vulnerability from certfr_avis - Published: 2026-06-12 - Updated: 2026-06-12
De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | Trident | Trident versions antérieures à 25.06.0 | ||
| NetApp | NetApp Console Agent | Console Agent versions antérieures à 4.3.0 | ||
| NetApp | Trident Autosupport | Trident Autosupport versions antérieures à 25.06.0 | ||
| NetApp | Trident Protect | Trident Protect sans le dernier correctif de sécurité | ||
| NetApp | NetApp Shift Toolkit | Shift Toolkit versions antérieures à 2.2 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Trident versions ant\u00e9rieures \u00e0 25.06.0",
"product": {
"name": "Trident",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Console Agent versions ant\u00e9rieures \u00e0 4.3.0",
"product": {
"name": "NetApp Console Agent",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Trident Autosupport versions ant\u00e9rieures \u00e0 25.06.0",
"product": {
"name": "Trident Autosupport",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Trident Protect sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Trident Protect",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Shift Toolkit versions ant\u00e9rieures \u00e0 2.2",
"product": {
"name": "NetApp Shift Toolkit",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-47907",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47907"
},
{
"name": "CVE-2024-12905",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12905"
},
{
"name": "CVE-2025-22870",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22870"
},
{
"name": "CVE-2023-24531",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24531"
}
],
"initial_release_date": "2026-06-12T00:00:00",
"last_revision_date": "2026-06-12T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0742",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
"vendor_advisories": [
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250328-0005",
"url": "https://security.netapp.com/advisory/NTAP-20250328-0005"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250829-0001",
"url": "https://security.netapp.com/advisory/NTAP-20250829-0001"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250509-0007",
"url": "https://security.netapp.com/advisory/NTAP-20250509-0007"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250801-0003",
"url": "https://security.netapp.com/advisory/NTAP-20250801-0003"
}
]
}
CERTFR-2026-AVI-0686
Vulnerability from certfr_avis - Published: 2026-06-04 - Updated: 2026-06-04
De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | Active IQ Config Advisor | Active IQ Config Advisor versions antérieures à 6.7.4 | ||
| NetApp | Active IQ OneCollect | Active IQ OneCollect versions antérieures à 2.7.4 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Active IQ Config Advisor versions ant\u00e9rieures \u00e0 6.7.4",
"product": {
"name": "Active IQ Config Advisor",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Active IQ OneCollect versions ant\u00e9rieures \u00e0 2.7.4",
"product": {
"name": "Active IQ OneCollect",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-22055",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22055"
},
{
"name": "CVE-2026-22054",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22054"
}
],
"initial_release_date": "2026-06-04T00:00:00",
"last_revision_date": "2026-06-04T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0686",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-04T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
"vendor_advisories": [
{
"published_at": "2026-06-03",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20260603-0001",
"url": "https://security.netapp.com/advisory/NTAP-20260603-0001"
},
{
"published_at": "2026-06-03",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20260603-0002",
"url": "https://security.netapp.com/advisory/NTAP-20260603-0002"
}
]
}
CERTFR-2026-AVI-0671
Vulnerability from certfr_avis - Published: 2026-06-01 - Updated: 2026-06-01
De multiples vulnérabilités ont été découvertes dans les produits NetApp. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | ONTAP tools pour VMware vSphere 10 | ONTAP tools pour VMware vSphere 10 versions antérieures à 10.3 | ||
| NetApp | Active IQ Unified Manager pour Microsoft Windows | Active IQ Unified Manager pour Microsoft Windows versions antérieures à 9.18P1 | ||
| NetApp | Brocade SAN Navigator (SANnav) | Brocade SAN Navigator (SANnav) versions antérieures à v2.3.1 | ||
| NetApp | Active IQ Unified Manager pour VMware vSphere | Active IQ Unified Manager pour VMware vSphere versions 9.18.x antérieures à 9.18P1 | ||
| NetApp | Active IQ Unified Manager pour Linux | Active IQ Unified Manager pour Linux versions antérieures à 9.18P1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ONTAP tools pour VMware vSphere 10 versions ant\u00e9rieures \u00e0 10.3",
"product": {
"name": "ONTAP tools pour VMware vSphere 10",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Active IQ Unified Manager pour Microsoft Windows versions ant\u00e9rieures \u00e0 9.18P1",
"product": {
"name": "Active IQ Unified Manager pour Microsoft Windows",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Brocade SAN Navigator (SANnav) versions ant\u00e9rieures \u00e0 v2.3.1",
"product": {
"name": "Brocade SAN Navigator (SANnav)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Active IQ Unified Manager pour VMware vSphere versions 9.18.x ant\u00e9rieures \u00e0 9.18P1",
"product": {
"name": "Active IQ Unified Manager pour VMware vSphere",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Active IQ Unified Manager pour Linux versions ant\u00e9rieures \u00e0 9.18P1",
"product": {
"name": "Active IQ Unified Manager pour Linux",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-53816",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53816"
},
{
"name": "CVE-2025-23367",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23367"
},
{
"name": "CVE-2025-48976",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
},
{
"name": "CVE-2023-20863",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20863"
},
{
"name": "CVE-2023-0482",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0482"
},
{
"name": "CVE-2024-22257",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22257"
},
{
"name": "CVE-2025-53817",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53817"
}
],
"initial_release_date": "2026-06-01T00:00:00",
"last_revision_date": "2026-06-01T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0671",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-01T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
"vendor_advisories": [
{
"published_at": "2026-05-27",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20240419-0005",
"url": "https://security.netapp.com/advisory/NTAP-20240419-0005"
},
{
"published_at": "2026-05-27",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20251107-0004",
"url": "https://security.netapp.com/advisory/NTAP-20251107-0004"
},
{
"published_at": "2026-05-27",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20251128-0012",
"url": "https://security.netapp.com/advisory/NTAP-20251128-0012"
},
{
"published_at": "2026-05-27",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20240524-0015",
"url": "https://security.netapp.com/advisory/NTAP-20240524-0015"
},
{
"published_at": "2026-05-27",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20260102-0015",
"url": "https://security.netapp.com/advisory/NTAP-20260102-0015"
},
{
"published_at": "2026-05-27",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20230427-0001",
"url": "https://security.netapp.com/advisory/NTAP-20230427-0001"
},
{
"published_at": "2026-05-27",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250829-0002",
"url": "https://security.netapp.com/advisory/NTAP-20250829-0002"
}
]
}
CERTFR-2026-AVI-0476
Vulnerability from certfr_avis - Published: 2026-04-22 - Updated: 2026-04-22
De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.16.x antérieures à 9.16.1P12 | ||
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.13.x antérieures à 9.13.1P20 | ||
| NetApp | StorageGRID | StorageGRID versions 11.x antérieures à 11.9.0.13 | ||
| NetApp | StorageGRID | StorageGRID versions 12.x antérieures à 12.0.0.6 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ONTAP versions 9.16.x ant\u00e9rieures \u00e0 9.16.1P12",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.13.x ant\u00e9rieures \u00e0 9.13.1P20",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "StorageGRID versions 11.x ant\u00e9rieures \u00e0 11.9.0.13",
"product": {
"name": "StorageGRID",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "StorageGRID versions 12.x ant\u00e9rieures \u00e0 12.0.0.6",
"product": {
"name": "StorageGRID",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-22051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22051"
},
{
"name": "CVE-2025-4516",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4516"
}
],
"initial_release_date": "2026-04-22T00:00:00",
"last_revision_date": "2026-04-22T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0476",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-04-22T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
"vendor_advisories": [
{
"published_at": "2026-04-22",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250711-0004",
"url": "https://security.netapp.com/advisory/NTAP-20250711-0004"
},
{
"published_at": "2026-04-20",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20260420-0001",
"url": "https://security.netapp.com/advisory/NTAP-20260420-0001"
}
]
}
CERTFR-2026-AVI-0363
Vulnerability from certfr_avis - Published: 2026-03-27 - Updated: 2026-03-27
De multiples vulnérabilités ont été découvertes dans les produits NetApp. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | NetApp ONTAP 9 versions antérieures à 9.16.1P12 | ||
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | NetApp ONTAP 9 versions 9.17.x antérieures à 9.17.1 | ||
| NetApp | Active IQ Unified Manager pour Microsoft Windows | Active IQ Unified Manager pour Microsoft Windows versions antérieures à 9.18 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetApp ONTAP 9 versions ant\u00e9rieures \u00e0 9.16.1P12",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp ONTAP 9 versions 9.17.x ant\u00e9rieures \u00e0 9.17.1",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Active IQ Unified Manager pour Microsoft Windows versions ant\u00e9rieures \u00e0 9.18",
"product": {
"name": "Active IQ Unified Manager pour Microsoft Windows",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-9287",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9287"
},
{
"name": "CVE-2025-1736",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1736"
},
{
"name": "CVE-2025-1219",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1219"
}
],
"initial_release_date": "2026-03-27T00:00:00",
"last_revision_date": "2026-03-27T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0363",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-27T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
"vendor_advisories": [
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250425-0006",
"url": "https://security.netapp.com/advisory/NTAP-20250425-0006"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250523-0007",
"url": "https://security.netapp.com/advisory/NTAP-20250523-0007"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250523-0006",
"url": "https://security.netapp.com/advisory/NTAP-20250523-0006"
}
]
}
CERTFR-2026-AVI-0287
Vulnerability from certfr_avis - Published: 2026-03-13 - Updated: 2026-03-13
De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | FAS/AFF Baseboard Management Controller (BMC) - A800/C800 | FAS/AFF Baseboard Management Controller (BMC) - A800/C800 versions antérieures à 10.10 | ||
| NetApp | SolidFire & HCI Storage Node (Element Software) | NetApp SolidFire & HCI Storage Node (Element Software) versions antérieures à 12.8 | ||
| NetApp | NetApp HCI Baseboard Management Controller (BMC) - H410C | NetApp HCI Baseboard Management Controller (BMC) - H410C | ||
| NetApp | N/A | Management Services for Element Software and NetApp HCI versions antérieures à 2.25.42 | ||
| NetApp | ONTAP Select Deploy administration utility | ONTAP Select Deploy administration utility versions antérieures à 9.14.1 | ||
| NetApp | E-Series SANtricity OS Controller Software 11.x | E-Series SANtricity OS Controller Software 11.x versions antérieures à 11.70.2 | ||
| NetApp | N/A | AFF/ASA/FAS Baseboard Management Controller (BMC) - A50/A30/A20/C60/C30/FAS50 versions antérieures à 19.1 | ||
| NetApp | FAS/AFF Baseboard Management Controller (BMC) - C190/A150/A220/FAS2720/FAS2750 | FAS/AFF Baseboard Management Controller (BMC) - C190/A150/A220/FAS2720/FAS2750 versions antérieures à 11.11 | ||
| NetApp | N/A | Astra Control Center versions antérieures à 23.10.0 | ||
| NetApp | NetApp HCI Baseboard Management Controller (BMC) - H610S | NetApp HCI Baseboard Management Controller (BMC) - H610S | ||
| NetApp | N/A | NetApp Cloud Backup (formerly AltaVault) | ||
| NetApp | N/A | Trident versions antérieures à 23.10.0 | ||
| NetApp | NetApp HCI Baseboard Management Controller (BMC) - H610C | NetApp HCI Baseboard Management Controller (BMC) - H410C | ||
| NetApp | N/A | Trident Autosupport versions antérieures à 23.10.0 | ||
| NetApp | Brocade Fabric Operating System Firmware | Brocade Fabric Operating System Firmware versions antérieures à 9.2.0 | ||
| NetApp | FAS/AFF Baseboard Management Controller (BMC) - A900/9500 | FAS/AFF Baseboard Management Controller (BMC) - A900/9500 versions antérieures à 16.6 | ||
| NetApp | N/A | FAS/AFF Baseboard Management Controller (BMC) - 8300/8700/A400/C400 versions antérieures à 13.10P1 | ||
| NetApp | Active IQ Unified Manager pour VMware vSphere | Active IQ Unified Manager for VMware vSphere versions antérieures à 9.16P2 | ||
| NetApp | N/A | AFF/ASA/FAS Baseboard Management Controller (BMC) - A1K/A90/A70/C80/FAS90/FAS70 versions antérieures à 18.2 | ||
| NetApp | NetApp HCI Baseboard Management Controller (BMC) - H610C | NetApp HCI Baseboard Management Controller (BMC) - H610C | ||
| NetApp | NetApp SolidFire & HCI Management Node | NetApp SolidFire & HCI Management Node versions antérieures à 2.25.42 | ||
| NetApp | NetApp SolidFire & HCI Management Node | NetApp SolidFire & HCI Management Node versions antérieures à 12.8 | ||
| NetApp | N/A | NetApp SolidFire Baseboard Management Controller (BMC) | ||
| NetApp | NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S | NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S | ||
| NetApp | FAS/AFF Baseboard Management Controller (BMC) - FAS2820 | FAS/AFF Baseboard Management Controller (BMC) - FAS2820 versions antérieures à 17.3 | ||
| NetApp | N/A | OnCommand Insight versions antérieures à 7.3.15 | ||
| NetApp | HCI Compute Node (Bootstrap OS) | NetApp HCI Compute Node (Bootstrap OS) |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "FAS/AFF Baseboard Management Controller (BMC) - A800/C800 versions ant\u00e9rieures \u00e0 10.10",
"product": {
"name": "FAS/AFF Baseboard Management Controller (BMC) - A800/C800",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp SolidFire \u0026 HCI Storage Node (Element Software) versions ant\u00e9rieures \u00e0 12.8",
"product": {
"name": "SolidFire \u0026 HCI Storage Node (Element Software)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp HCI Baseboard Management Controller (BMC) - H410C",
"product": {
"name": "NetApp HCI Baseboard Management Controller (BMC) - H410C",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Management Services for Element Software and NetApp HCI versions ant\u00e9rieures \u00e0 2.25.42",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP Select Deploy administration utility versions ant\u00e9rieures \u00e0 9.14.1",
"product": {
"name": "ONTAP Select Deploy administration utility",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "E-Series SANtricity OS Controller Software 11.x versions ant\u00e9rieures \u00e0 11.70.2",
"product": {
"name": "E-Series SANtricity OS Controller Software 11.x",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "AFF/ASA/FAS Baseboard Management Controller (BMC) - A50/A30/A20/C60/C30/FAS50 versions ant\u00e9rieures \u00e0 19.1",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "FAS/AFF Baseboard Management Controller (BMC) - C190/A150/A220/FAS2720/FAS2750 versions ant\u00e9rieures \u00e0 11.11",
"product": {
"name": "FAS/AFF Baseboard Management Controller (BMC) - C190/A150/A220/FAS2720/FAS2750",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Astra Control Center versions ant\u00e9rieures \u00e0 23.10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp HCI Baseboard Management Controller (BMC) - H610S",
"product": {
"name": "NetApp HCI Baseboard Management Controller (BMC) - H610S",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp Cloud Backup (formerly AltaVault)",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Trident versions ant\u00e9rieures \u00e0 23.10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp HCI Baseboard Management Controller (BMC) - H410C",
"product": {
"name": "NetApp HCI Baseboard Management Controller (BMC) - H610C",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Trident Autosupport versions ant\u00e9rieures \u00e0 23.10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Brocade Fabric Operating System Firmware versions ant\u00e9rieures \u00e0 9.2.0",
"product": {
"name": "Brocade Fabric Operating System Firmware",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "FAS/AFF Baseboard Management Controller (BMC) - A900/9500 versions ant\u00e9rieures \u00e0 16.6",
"product": {
"name": "FAS/AFF Baseboard Management Controller (BMC) - A900/9500",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "FAS/AFF Baseboard Management Controller (BMC) - 8300/8700/A400/C400 versions ant\u00e9rieures \u00e0 13.10P1",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Active IQ Unified Manager for VMware vSphere versions ant\u00e9rieures \u00e0 9.16P2",
"product": {
"name": "Active IQ Unified Manager pour VMware vSphere",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "AFF/ASA/FAS Baseboard Management Controller (BMC) - A1K/A90/A70/C80/FAS90/FAS70 versions ant\u00e9rieures \u00e0 18.2",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp HCI Baseboard Management Controller (BMC) - H610C",
"product": {
"name": "NetApp HCI Baseboard Management Controller (BMC) - H610C",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp SolidFire \u0026 HCI Management Node versions ant\u00e9rieures \u00e0 2.25.42",
"product": {
"name": "NetApp SolidFire \u0026 HCI Management Node",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp SolidFire \u0026 HCI Management Node versions ant\u00e9rieures \u00e0 12.8",
"product": {
"name": "NetApp SolidFire \u0026 HCI Management Node",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp SolidFire Baseboard Management Controller (BMC)",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S",
"product": {
"name": "NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "FAS/AFF Baseboard Management Controller (BMC) - FAS2820 versions ant\u00e9rieures \u00e0 17.3",
"product": {
"name": "FAS/AFF Baseboard Management Controller (BMC) - FAS2820",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "OnCommand Insight versions ant\u00e9rieures \u00e0 7.3.15",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp HCI Compute Node (Bootstrap OS)",
"product": {
"name": "HCI Compute Node (Bootstrap OS)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2022-30594",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30594"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2022-28893",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28893"
},
{
"name": "CVE-2023-3341",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3341"
},
{
"name": "CVE-2022-2309",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2309"
},
{
"name": "CVE-2021-33909",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33909"
},
{
"name": "CVE-2022-0492",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0492"
},
{
"name": "CVE-2022-23218",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23218"
},
{
"name": "CVE-2024-26633",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26633"
},
{
"name": "CVE-2021-35942",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35942"
},
{
"name": "CVE-2024-26641",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26641"
},
{
"name": "CVE-2022-23219",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23219"
}
],
"initial_release_date": "2026-03-13T00:00:00",
"last_revision_date": "2026-03-13T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0287",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
"vendor_advisories": [
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20210827-0005",
"url": "https://security.netapp.com/advisory/NTAP-20210827-0005"
},
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220915-0006",
"url": "https://security.netapp.com/advisory/NTAP-20220915-0006"
},
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20231016-0001",
"url": "https://security.netapp.com/advisory/NTAP-20231016-0001"
},
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220131-0003",
"url": "https://security.netapp.com/advisory/NTAP-20220131-0003"
},
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20210819-0004",
"url": "https://security.netapp.com/advisory/NTAP-20210819-0004"
},
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20241220-0001",
"url": "https://security.netapp.com/advisory/NTAP-20241220-0001"
},
{
"published_at": "2026-03-12",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20231013-0003",
"url": "https://security.netapp.com/advisory/NTAP-20231013-0003"
},
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220419-0002",
"url": "https://security.netapp.com/advisory/NTAP-20220419-0002"
},
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220526-0002",
"url": "https://security.netapp.com/advisory/NTAP-20220526-0002"
},
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20241108-0008",
"url": "https://security.netapp.com/advisory/NTAP-20241108-0008"
},
{
"published_at": "2026-03-11",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220707-0001",
"url": "https://security.netapp.com/advisory/NTAP-20220707-0001"
}
]
}
CERTFR-2026-AVI-0238
Vulnerability from certfr_avis - Published: 2026-03-05 - Updated: 2026-03-05
Une vulnérabilité a été découverte dans NetApp ONTAP 9. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.16.x antérieures à 9.16.1P8 | ||
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.17.x antérieures à 9.17.1P1 | ||
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.18.x antérieures à 9.18.1 | ||
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.14.x antérieures à 9.14.1P16 | ||
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.13.x antérieures à 9.13.1P19 | ||
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions antérieures à 9.12.1P20 | ||
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.15.x antérieures à 9.15.1P16 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ONTAP versions 9.16.x ant\u00e9rieures \u00e0 9.16.1P8",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.17.x ant\u00e9rieures \u00e0 9.17.1P1",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.18.x ant\u00e9rieures \u00e0 9.18.1",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.14.x ant\u00e9rieures \u00e0 9.14.1P16",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.13.x ant\u00e9rieures \u00e0 9.13.1P19",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions ant\u00e9rieures \u00e0 9.12.1P20",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.15.x ant\u00e9rieures \u00e0 9.15.1P16",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-22052",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22052"
}
],
"initial_release_date": "2026-03-05T00:00:00",
"last_revision_date": "2026-03-05T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0238",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-05T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp ONTAP 9. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Vuln\u00e9rabilit\u00e9 dans NetApp ONTAP 9",
"vendor_advisories": [
{
"published_at": "2026-03-04",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20260304-0001",
"url": "https://security.netapp.com/advisory/NTAP-20260304-0001"
}
]
}
CERTFR-2026-AVI-0180
Vulnerability from certfr_avis - Published: 2026-02-18 - Updated: 2026-02-18
Une vulnérabilité a été découverte dans NetApp StorageGRID. Elle permet à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et une falsification de requêtes côté serveur (SSRF).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | StorageGRID | StorageGRID versions 12.x antérieures à 12.0.0.4 | ||
| NetApp | StorageGRID | StorageGRID versions antérieures à 11.9.0.12 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "StorageGRID versions 12.x ant\u00e9rieures \u00e0 12.0.0.4",
"product": {
"name": "StorageGRID",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "StorageGRID versions ant\u00e9rieures \u00e0 11.9.0.12",
"product": {
"name": "StorageGRID",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-22048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22048"
}
],
"initial_release_date": "2026-02-18T00:00:00",
"last_revision_date": "2026-02-18T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0180",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-18T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp StorageGRID. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
"title": "Vuln\u00e9rabilit\u00e9 dans NetApp StorageGRID",
"vendor_advisories": [
{
"published_at": "2026-02-17",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20260217-0001",
"url": "https://security.netapp.com/advisory/NTAP-20260217-0001"
}
]
}
CERTFR-2026-AVI-0127
Vulnerability from certfr_avis - Published: 2026-02-06 - Updated: 2026-02-06
Une vulnérabilité a été découverte dans NetApp ONTAP 9. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | NetApp ONTAP 9 versions antérieures à 9.18.1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetApp ONTAP 9 versions ant\u00e9rieures \u00e0 9.18.1",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-2884",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-2884"
}
],
"initial_release_date": "2026-02-06T00:00:00",
"last_revision_date": "2026-02-06T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0127",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp ONTAP 9. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Vuln\u00e9rabilit\u00e9 dans NetApp ONTAP 9",
"vendor_advisories": [
{
"published_at": "2026-02-06",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250620-0007",
"url": "https://security.netapp.com/advisory/NTAP-20250620-0007"
}
]
}
CERTFR-2026-AVI-0085
Vulnerability from certfr_avis - Published: 2026-01-26 - Updated: 2026-01-26
De multiples vulnérabilités ont été découvertes dans NetApp Brocade SAN Navigator. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | Brocade SAN Navigator (SANnav) | Brocade SAN Navigator versions antérieures à 3.0 | ||
| NetApp | Brocade SAN Navigator (SANnav) | Brocade SAN Navigator versions antérieures à 2.4.0b |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Brocade SAN Navigator versions ant\u00e9rieures \u00e0 3.0",
"product": {
"name": "Brocade SAN Navigator (SANnav)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "Brocade SAN Navigator versions ant\u00e9rieures \u00e0 2.4.0b",
"product": {
"name": "Brocade SAN Navigator (SANnav)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [],
"initial_release_date": "2026-01-26T00:00:00",
"last_revision_date": "2026-01-26T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0085",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-01-26T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans NetApp Brocade SAN Navigator. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans NetApp Brocade SAN Navigator",
"vendor_advisories": [
{
"published_at": "2026-01-21",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20251205-0004",
"url": "https://security.netapp.com/advisory/NTAP-20251205-0004"
},
{
"published_at": "2026-01-21",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20251205-0005",
"url": "https://security.netapp.com/advisory/NTAP-20251205-0005"
}
]
}
CERTFR-2026-AVI-0027
Vulnerability from certfr_avis - Published: 2026-01-13 - Updated: 2026-01-13
Une vulnérabilité a été découverte dans NetApp ONTAP. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.17.1x antérieures à 9.17.1P2 | ||
| NetApp | ONTAP 9 (formerly Clustered Data ONTAP) | ONTAP versions 9.16.1x antérieures à 9.16.1P9 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ONTAP versions 9.17.1x ant\u00e9rieures \u00e0 9.17.1P2",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.16.1x ant\u00e9rieures \u00e0 9.16.1P9",
"product": {
"name": "ONTAP 9 (formerly Clustered Data ONTAP)",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-22050",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22050"
}
],
"initial_release_date": "2026-01-13T00:00:00",
"last_revision_date": "2026-01-13T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0027",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-01-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp ONTAP. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans NetApp ONTAP",
"vendor_advisories": [
{
"published_at": "2026-01-12",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20260112-0001",
"url": "https://security.netapp.com/advisory/NTAP-20260112-0001"
}
]
}
CERTFR-2025-AVI-1125
Vulnerability from certfr_avis - Published: 2025-12-19 - Updated: 2025-12-19
Une vulnérabilité a été découverte dans les produits NetApp. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetApp SolidFire Baseboard Management Controller (BMC) toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp Cloud Backup toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "NetApp SolidFire \u0026 HCI Management Node sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "SolidFire \u0026 HCI Management Node",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2007-2768",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-2768"
}
],
"initial_release_date": "2025-12-19T00:00:00",
"last_revision_date": "2025-12-19T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-1125",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-12-19T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits NetApp. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits NetApp",
"vendor_advisories": [
{
"published_at": "2025-12-17",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20191107-0002",
"url": "https://security.netapp.com/advisory/NTAP-20191107-0002"
}
]
}
CERTFR-2025-AVI-1065
Vulnerability from certfr_avis - Published: 2025-12-05 - Updated: 2025-12-05
De multiples vulnérabilités ont été découvertes dans NetApp ONTAP. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| NetApp | ONTAP | ONTAP versions 9.13.x antérieures à 9.13.1P18 | ||
| NetApp | ONTAP | ONTAP versions 9.16.x antérieures à 9.16.1P9 | ||
| NetApp | ONTAP | ONTAP versions 9.14.x antérieures à 9.14.1P15 | ||
| NetApp | ONTAP | ONTAP versions 9.17.x antérieures à 9.17.1P1 | ||
| NetApp | ONTAP tools pour VMware vSphere 10 | ONTAP tools pour VMware vSphere 10 versions antérieures à 10.4 | ||
| NetApp | ONTAP | ONTAP versions 9.15.x antérieures à 9.15.1P13 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ONTAP versions 9.13.x ant\u00e9rieures \u00e0 9.13.1P18",
"product": {
"name": "ONTAP",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.16.x ant\u00e9rieures \u00e0 9.16.1P9",
"product": {
"name": "ONTAP",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.14.x ant\u00e9rieures \u00e0 9.14.1P15",
"product": {
"name": "ONTAP",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.17.x ant\u00e9rieures \u00e0 9.17.1P1",
"product": {
"name": "ONTAP",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP tools pour VMware vSphere 10 versions ant\u00e9rieures \u00e0 10.4",
"product": {
"name": "ONTAP tools pour VMware vSphere 10",
"vendor": {
"name": "NetApp",
"scada": false
}
}
},
{
"description": "ONTAP versions 9.15.x ant\u00e9rieures \u00e0 9.15.1P13",
"product": {
"name": "ONTAP",
"vendor": {
"name": "NetApp",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-23048",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23048"
},
{
"name": "CVE-2025-49812",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49812"
},
{
"name": "CVE-2024-43204",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43204"
},
{
"name": "CVE-2025-53020",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53020"
},
{
"name": "CVE-2024-47252",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47252"
},
{
"name": "CVE-2024-55549",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-55549"
},
{
"name": "CVE-2025-24855",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24855"
},
{
"name": "CVE-2025-49630",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49630"
},
{
"name": "CVE-2024-42516",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42516"
},
{
"name": "CVE-2024-43394",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43394"
}
],
"initial_release_date": "2025-12-05T00:00:00",
"last_revision_date": "2025-12-05T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-1065",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-12-05T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans NetApp ONTAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans NetApp ONTAP",
"vendor_advisories": [
{
"published_at": "2025-12-05",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250613-0007",
"url": "https://security.netapp.com/advisory/NTAP-20250613-0007"
},
{
"published_at": "2025-12-05",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250613-0006",
"url": "https://security.netapp.com/advisory/NTAP-20250613-0006"
},
{
"published_at": "2025-12-05",
"title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20250718-0013",
"url": "https://security.netapp.com/advisory/NTAP-20250718-0013"
}
]
}
CVE-2026-22055 (GCVE-0-2026-22055)
Vulnerability from nvd – Published: 2026-06-03 21:55 – Updated: 2026-06-04 13:12
VLAI
Summary
Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 259
- CWE-259 - Use of Hard-coded Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20260603-0002 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NETAPP | Active IQ OneCollect |
Affected:
2.7.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22055",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T13:12:13.974572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "CWE-259 Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T13:12:28.392Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Active IQ OneCollect",
"vendor": "NETAPP",
"versions": [
{
"status": "affected",
"version": "2.7.3",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations."
}
],
"value": "Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "259",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T21:55:30.988Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20260603-0002"
}
],
"source": {
"advisory": "NTAP-20260603-0002",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22055",
"datePublished": "2026-06-03T21:55:30.988Z",
"dateReserved": "2026-01-05T22:47:18.702Z",
"dateUpdated": "2026-06-04T13:12:28.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22054 (GCVE-0-2026-22054)
Vulnerability from nvd – Published: 2026-06-03 21:53 – Updated: 2026-06-04 13:14
VLAI
Summary
Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 259
- CWE-259 - Use of Hard-coded Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20260603-0001 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NETAPP | Active IQ Config Advisor |
Affected:
6.7.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T13:14:16.249619Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "CWE-259 Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T13:14:19.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Active IQ Config Advisor",
"vendor": "NETAPP",
"versions": [
{
"status": "affected",
"version": "6.7.3",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations."
}
],
"value": "Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "259",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T21:53:48.297Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20260603-0001"
}
],
"source": {
"advisory": "NTAP-20260603-0001",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22054",
"datePublished": "2026-06-03T21:53:48.297Z",
"dateReserved": "2026-01-05T22:47:18.702Z",
"dateUpdated": "2026-06-04T13:14:19.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22051 (GCVE-0-2026-22051)
Vulnerability from nvd – Published: 2026-04-20 21:27 – Updated: 2026-04-21 13:40
VLAI
Summary
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 213
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20260420-0001 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NETAPP | StorageGRID (formerly StorageGRID Webscale) |
Affected:
0 , < 11.9.0.13
(custom)
Affected: 0 , < 12.0.0.6 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22051",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-21T13:40:42.595085Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T13:40:46.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "StorageGRID (formerly StorageGRID Webscale)",
"vendor": "NETAPP",
"versions": [
{
"lessThan": "11.9.0.13",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.0.0.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to."
}
],
"value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "213",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T21:28:04.859Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20260420-0001"
}
],
"source": {
"advisory": "NTAP-20260420-0001",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22051",
"datePublished": "2026-04-20T21:27:36.822Z",
"dateReserved": "2026-01-05T22:47:18.701Z",
"dateUpdated": "2026-04-21T13:40:46.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22052 (GCVE-0-2026-22052)
Vulnerability from nvd – Published: 2026-03-04 23:22 – Updated: 2026-03-06 18:25
VLAI
Summary
ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 209
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22052",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-06T18:25:10.691167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T18:25:24.078Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONTAP 9",
"vendor": "NETAPP",
"versions": [
{
"status": "affected",
"version": "9.12.1 and higher"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission."
}
],
"value": "ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "209",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T23:22:22.957Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20260304-0001"
}
],
"source": {
"advisory": "NTAP-20260304-0001",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22052",
"datePublished": "2026-03-04T23:22:22.957Z",
"dateReserved": "2026-01-05T22:47:18.701Z",
"dateUpdated": "2026-03-06T18:25:24.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22048 (GCVE-0-2026-22048)
Vulnerability from nvd – Published: 2026-02-17 23:01 – Updated: 2026-02-18 13:44
VLAI
Summary
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 918
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NETAPP | StorageGRID (formerly StorageGRID Webscale) |
Affected:
0 , < 11.9.0.12
(custom)
Affected: 12.0.0.0 , < 12.0.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22048",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-18T13:43:51.738952Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-18T13:44:08.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "StorageGRID (formerly StorageGRID Webscale)",
"vendor": "NETAPP",
"versions": [
{
"lessThan": "11.9.0.12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.0.0.4",
"status": "affected",
"version": "12.0.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources."
}
],
"value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "918",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-17T23:01:30.331Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20260217-0001"
}
],
"source": {
"advisory": "NTAP-20260217-0001",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22048",
"datePublished": "2026-02-17T23:01:30.331Z",
"dateReserved": "2026-01-05T22:47:18.701Z",
"dateUpdated": "2026-02-18T13:44:08.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22050 (GCVE-0-2026-22050)
Vulnerability from nvd – Published: 2026-01-12 17:15 – Updated: 2026-01-13 17:30
VLAI
Summary
ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 639
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-12T17:36:52.693542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T17:30:51.952Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONTAP 9",
"vendor": "NETAPP",
"versions": [
{
"lessThan": "9.16.1P9",
"status": "affected",
"version": "9.16.1",
"versionType": "custom"
},
{
"lessThan": "9.17.1P2",
"status": "affected",
"version": "9.17.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none."
}
],
"value": "ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "639",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-12T17:15:07.484Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20260112-0001"
}
],
"source": {
"advisory": "NTAP-20260112-0001",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22050",
"datePublished": "2026-01-12T17:15:07.484Z",
"dateReserved": "2026-01-05T22:47:18.701Z",
"dateUpdated": "2026-01-13T17:30:51.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-26517 (GCVE-0-2025-26517)
Vulnerability from nvd – Published: 2025-09-19 18:53 – Updated: 2025-09-19 19:07
VLAI
Title
CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Summary
StorageGRID (formerly
StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are
susceptible to a privilege escalation vulnerability. Successful exploit
could allow an unauthorized authenticated attacker to discover Grid node
names and IP addresses or modify Storage Grades.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NetApp | StorageGRID |
Affected:
0 , < 11.8.0.15
(custom)
Affected: 0 , < 11.9.0.8 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-26517",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T19:07:15.855472Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T19:07:36.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "StorageGRID",
"vendor": "NetApp",
"versions": [
{
"lessThan": "11.8.0.15",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "11.9.0.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\n\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eStorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a privilege escalation vulnerability. Successful exploit \ncould allow an unauthorized authenticated attacker to discover Grid node\n names and IP addresses or modify Storage Grades. \u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a privilege escalation vulnerability. Successful exploit \ncould allow an unauthorized authenticated attacker to discover Grid node\n names and IP addresses or modify Storage Grades."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T18:53:07.531Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20250910-0004"
}
],
"source": {
"advisory": "NTAP-20250910-0004",
"discovery": "UNKNOWN"
},
"title": "CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2025-26517",
"datePublished": "2025-09-19T18:53:07.531Z",
"dateReserved": "2025-02-11T21:58:04.395Z",
"dateUpdated": "2025-09-19T19:07:36.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-26516 (GCVE-0-2025-26516)
Vulnerability from nvd – Published: 2025-09-19 18:51 – Updated: 2025-09-19 19:06
VLAI
Title
CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Summary
StorageGRID (formerly
StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are
susceptible to a Denial of Service vulnerability. Successful exploit
could allow an unauthenticated attacker to cause a Denial of Service on
the Admin node.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-405 - Asymmetric Resource Consumption (Amplification)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NetApp | StorageGRID |
Affected:
0 , < 11.8.0.15
(custom)
Affected: 0 , < 11.9.0.8 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-26516",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T19:06:15.932920Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T19:06:24.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "StorageGRID",
"vendor": "NetApp",
"versions": [
{
"lessThan": "11.8.0.15",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "11.9.0.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eStorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a Denial of Service vulnerability. Successful exploit \ncould allow an unauthenticated attacker to cause a Denial of Service on \nthe Admin node.\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a Denial of Service vulnerability. Successful exploit \ncould allow an unauthenticated attacker to cause a Denial of Service on \nthe Admin node."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T18:51:12.609Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20250910-0003"
}
],
"source": {
"advisory": "NTAP-20250910-0003",
"discovery": "UNKNOWN"
},
"title": "CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2025-26516",
"datePublished": "2025-09-19T18:51:12.609Z",
"dateReserved": "2025-02-11T21:58:04.395Z",
"dateUpdated": "2025-09-19T19:06:24.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-22055 (GCVE-0-2026-22055)
Vulnerability from cvelistv5 – Published: 2026-06-03 21:55 – Updated: 2026-06-04 13:12
VLAI
Summary
Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 259
- CWE-259 - Use of Hard-coded Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20260603-0002 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NETAPP | Active IQ OneCollect |
Affected:
2.7.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22055",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T13:12:13.974572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "CWE-259 Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T13:12:28.392Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Active IQ OneCollect",
"vendor": "NETAPP",
"versions": [
{
"status": "affected",
"version": "2.7.3",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations."
}
],
"value": "Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "259",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T21:55:30.988Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20260603-0002"
}
],
"source": {
"advisory": "NTAP-20260603-0002",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22055",
"datePublished": "2026-06-03T21:55:30.988Z",
"dateReserved": "2026-01-05T22:47:18.702Z",
"dateUpdated": "2026-06-04T13:12:28.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22054 (GCVE-0-2026-22054)
Vulnerability from cvelistv5 – Published: 2026-06-03 21:53 – Updated: 2026-06-04 13:14
VLAI
Summary
Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 259
- CWE-259 - Use of Hard-coded Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20260603-0001 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NETAPP | Active IQ Config Advisor |
Affected:
6.7.3
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T13:14:16.249619Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "CWE-259 Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T13:14:19.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Active IQ Config Advisor",
"vendor": "NETAPP",
"versions": [
{
"status": "affected",
"version": "6.7.3",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations."
}
],
"value": "Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "259",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T21:53:48.297Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20260603-0001"
}
],
"source": {
"advisory": "NTAP-20260603-0001",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22054",
"datePublished": "2026-06-03T21:53:48.297Z",
"dateReserved": "2026-01-05T22:47:18.702Z",
"dateUpdated": "2026-06-04T13:14:19.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22051 (GCVE-0-2026-22051)
Vulnerability from cvelistv5 – Published: 2026-04-20 21:27 – Updated: 2026-04-21 13:40
VLAI
Summary
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 213
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.netapp.com/advisory/ntap-20260420-0001 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NETAPP | StorageGRID (formerly StorageGRID Webscale) |
Affected:
0 , < 11.9.0.13
(custom)
Affected: 0 , < 12.0.0.6 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22051",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-21T13:40:42.595085Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T13:40:46.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "StorageGRID (formerly StorageGRID Webscale)",
"vendor": "NETAPP",
"versions": [
{
"lessThan": "11.9.0.13",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.0.0.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to."
}
],
"value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "213",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T21:28:04.859Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20260420-0001"
}
],
"source": {
"advisory": "NTAP-20260420-0001",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22051",
"datePublished": "2026-04-20T21:27:36.822Z",
"dateReserved": "2026-01-05T22:47:18.701Z",
"dateUpdated": "2026-04-21T13:40:46.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22052 (GCVE-0-2026-22052)
Vulnerability from cvelistv5 – Published: 2026-03-04 23:22 – Updated: 2026-03-06 18:25
VLAI
Summary
ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 209
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22052",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-06T18:25:10.691167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T18:25:24.078Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONTAP 9",
"vendor": "NETAPP",
"versions": [
{
"status": "affected",
"version": "9.12.1 and higher"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission."
}
],
"value": "ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "209",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T23:22:22.957Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20260304-0001"
}
],
"source": {
"advisory": "NTAP-20260304-0001",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22052",
"datePublished": "2026-03-04T23:22:22.957Z",
"dateReserved": "2026-01-05T22:47:18.701Z",
"dateUpdated": "2026-03-06T18:25:24.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22048 (GCVE-0-2026-22048)
Vulnerability from cvelistv5 – Published: 2026-02-17 23:01 – Updated: 2026-02-18 13:44
VLAI
Summary
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 918
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NETAPP | StorageGRID (formerly StorageGRID Webscale) |
Affected:
0 , < 11.9.0.12
(custom)
Affected: 12.0.0.0 , < 12.0.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22048",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-18T13:43:51.738952Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-18T13:44:08.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "StorageGRID (formerly StorageGRID Webscale)",
"vendor": "NETAPP",
"versions": [
{
"lessThan": "11.9.0.12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "12.0.0.4",
"status": "affected",
"version": "12.0.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources."
}
],
"value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "918",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-17T23:01:30.331Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20260217-0001"
}
],
"source": {
"advisory": "NTAP-20260217-0001",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22048",
"datePublished": "2026-02-17T23:01:30.331Z",
"dateReserved": "2026-01-05T22:47:18.701Z",
"dateUpdated": "2026-02-18T13:44:08.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22050 (GCVE-0-2026-22050)
Vulnerability from cvelistv5 – Published: 2026-01-12 17:15 – Updated: 2026-01-13 17:30
VLAI
Summary
ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- 639
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-12T17:36:52.693542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T17:30:51.952Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONTAP 9",
"vendor": "NETAPP",
"versions": [
{
"lessThan": "9.16.1P9",
"status": "affected",
"version": "9.16.1",
"versionType": "custom"
},
{
"lessThan": "9.17.1P2",
"status": "affected",
"version": "9.17.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none."
}
],
"value": "ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "639",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-12T17:15:07.484Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20260112-0001"
}
],
"source": {
"advisory": "NTAP-20260112-0001",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2026-22050",
"datePublished": "2026-01-12T17:15:07.484Z",
"dateReserved": "2026-01-05T22:47:18.701Z",
"dateUpdated": "2026-01-13T17:30:51.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-26517 (GCVE-0-2025-26517)
Vulnerability from cvelistv5 – Published: 2025-09-19 18:53 – Updated: 2025-09-19 19:07
VLAI
Title
CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Summary
StorageGRID (formerly
StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are
susceptible to a privilege escalation vulnerability. Successful exploit
could allow an unauthorized authenticated attacker to discover Grid node
names and IP addresses or modify Storage Grades.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NetApp | StorageGRID |
Affected:
0 , < 11.8.0.15
(custom)
Affected: 0 , < 11.9.0.8 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-26517",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T19:07:15.855472Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T19:07:36.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "StorageGRID",
"vendor": "NetApp",
"versions": [
{
"lessThan": "11.8.0.15",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "11.9.0.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\n\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eStorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a privilege escalation vulnerability. Successful exploit \ncould allow an unauthorized authenticated attacker to discover Grid node\n names and IP addresses or modify Storage Grades. \u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a privilege escalation vulnerability. Successful exploit \ncould allow an unauthorized authenticated attacker to discover Grid node\n names and IP addresses or modify Storage Grades."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T18:53:07.531Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20250910-0004"
}
],
"source": {
"advisory": "NTAP-20250910-0004",
"discovery": "UNKNOWN"
},
"title": "CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2025-26517",
"datePublished": "2025-09-19T18:53:07.531Z",
"dateReserved": "2025-02-11T21:58:04.395Z",
"dateUpdated": "2025-09-19T19:07:36.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-26516 (GCVE-0-2025-26516)
Vulnerability from cvelistv5 – Published: 2025-09-19 18:51 – Updated: 2025-09-19 19:06
VLAI
Title
CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Summary
StorageGRID (formerly
StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are
susceptible to a Denial of Service vulnerability. Successful exploit
could allow an unauthenticated attacker to cause a Denial of Service on
the Admin node.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-405 - Asymmetric Resource Consumption (Amplification)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NetApp | StorageGRID |
Affected:
0 , < 11.8.0.15
(custom)
Affected: 0 , < 11.9.0.8 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-26516",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T19:06:15.932920Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T19:06:24.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "StorageGRID",
"vendor": "NetApp",
"versions": [
{
"lessThan": "11.8.0.15",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "11.9.0.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eStorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a Denial of Service vulnerability. Successful exploit \ncould allow an unauthenticated attacker to cause a Denial of Service on \nthe Admin node.\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a Denial of Service vulnerability. Successful exploit \ncould allow an unauthenticated attacker to cause a Denial of Service on \nthe Admin node."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T18:51:12.609Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20250910-0003"
}
],
"source": {
"advisory": "NTAP-20250910-0003",
"discovery": "UNKNOWN"
},
"title": "CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2025-26516",
"datePublished": "2025-09-19T18:51:12.609Z",
"dateReserved": "2025-02-11T21:58:04.395Z",
"dateUpdated": "2025-09-19T19:06:24.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-26515 (GCVE-0-2025-26515)
Vulnerability from cvelistv5 – Published: 2025-09-19 18:34 – Updated: 2025-09-19 18:46
VLAI
Title
CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Summary
StorageGRID (formerly
StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without
Single Sign-on enabled are susceptible to a Server-Side Request Forgery
(SSRF) vulnerability. Successful exploit could allow an unauthenticated
attacker to change the password of any Grid Manager or Tenant Manager
non-federated user.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NetApp | StorageGRID |
Affected:
0 , < 11.8.0.15
(custom)
Affected: 0 , < 11.9.0.8 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-26515",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T18:46:25.909641Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T18:46:37.919Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "StorageGRID",
"vendor": "NetApp",
"versions": [
{
"lessThan": "11.8.0.15",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "11.9.0.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\n\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\n\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eStorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without \nSingle Sign-on enabled are susceptible to a Server-Side Request Forgery \n(SSRF) vulnerability. Successful exploit could allow an unauthenticated \nattacker to change the password of any Grid Manager or Tenant Manager \nnon-federated user.\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without \nSingle Sign-on enabled are susceptible to a Server-Side Request Forgery \n(SSRF) vulnerability. Successful exploit could allow an unauthenticated \nattacker to change the password of any Grid Manager or Tenant Manager \nnon-federated user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T18:34:17.283Z",
"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"shortName": "netapp"
},
"references": [
{
"url": "https://security.netapp.com/advisory/NTAP-20250910-0002"
}
],
"source": {
"advisory": "NTAP-20250910-0002",
"discovery": "UNKNOWN"
},
"title": "CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
"assignerShortName": "netapp",
"cveId": "CVE-2025-26515",
"datePublished": "2025-09-19T18:34:17.283Z",
"dateReserved": "2025-02-11T21:58:04.395Z",
"dateUpdated": "2025-09-19T18:46:37.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}