CVE-2026-22049 affects NETAPP ONTAP 9.16.1 when WebAuthn MFA is enabled. The vulnerability involves improper handling of the Relying Party ID, which is a critical parameter in WebAuthn authentication flows. Exploiting this issue could enable an attacker possessing valid user credentials to bypass the MFA protections, effectively reducing the security of the authentication process. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

An attacker with valid credentials can bypass the multi-factor authentication configured via WebAuthn, potentially gaining unauthorized access to the system. This undermines the security benefits of MFA and increases the risk of account compromise and subsequent unauthorized actions within the affected ONTAP environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider additional compensating controls such as restricting network access, monitoring for suspicious authentication activity, or temporarily disabling WebAuthn MFA if feasible and safe to do so.