CVE-2026-22054 is a vulnerability in NETAPP Active IQ Config Advisor version 6.7.3 where hard-coded credentials exist within the software. These credentials could enable an attacker who is already authenticated with low privileges to escalate their capabilities and perform unauthorized AutoSupport operations. The vulnerability is network exploitable with low attack complexity and does not require user interaction. The CVSS 4.0 vector indicates no privileges required beyond low privileges and no user interaction is needed.

An attacker with low-level authenticated access to the affected version of Active IQ Config Advisor could misuse hard-coded credentials to perform unauthorized AutoSupport operations. This could potentially lead to unauthorized system information disclosure or configuration changes via the AutoSupport feature. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected version of Active IQ Config Advisor to trusted users only and monitor for unusual AutoSupport activity. Avoid using version 6.7.3 in production environments if possible.