NETAPP
Vulnerability activity for NETAPP: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 10
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.9MediumNov 3, 2026NETAPP StorageGRID (formerly StorageGRID Webscale) Auth bypass / access controlCVE-2026-22060All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.
- 9.1CriticalNov 3, 2026NETAPP StorageGRID (formerly StorageGRID Webscale) Auth bypass / access controlCVE-2026-22058StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.
- 6.0MediumOct 27, 2026NetApp ONTAP 9 Crypto / certificateCVE-2026-22063The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
- 8.2HighOct 9, 2026NetApp TridentCVE-2026-22061Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.
- 8.8HighJul 22, 2026Netapp ontap Auth bypass / access controlCVE-2026-22049ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.
- 8.8HighJun 3, 2026Netapp active iq onecollect Auth bypass / access controlCVE-2026-22055Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
- 8.8HighJun 3, 2026Netapp active iq config advisor Auth bypass / access controlCVE-2026-22054Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
- 4.3MediumApr 20, 2026Netapp storagegrid Information disclosureCVE-2026-22051StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to.
- 4.3MediumMar 5, 2026Netapp ontap Information disclosureCVE-2026-22052ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.
- 4.3MediumJan 12, 2026Netapp ontap Auth bypass / access controlCVE-2026-22050ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none.
- 7.5HighFeb 19, 2024Netapp active iq unified manager Denial of serviceCVE-2024-1635A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed4.6% likely
Top products
- ontap3 CVEs in the last year
- StorageGRID (formerly StorageGRID Webscale)2 CVEs in the last year, 1 critical
- Trident1 CVE in the last year
- storagegrid1 CVE in the last year
- ONTAP 91 CVE in the last year
- active iq onecollect1 CVE in the last year
- active iq config advisor1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.