CVE-2026-22056: CWE-774 Allocation of file descriptors or handles without limits or throttling in NetApp StorageGRID

CVE-2026-22056 is a denial of service vulnerability in NetApp StorageGRID (version 11.5) arising from the allocation of file descriptors or handles without proper limits or throttling (CWE-774). This flaw can be triggered in non-standard configurations and scenarios, potentially allowing an attacker with limited privileges and some control over the environment to cause a partial denial of service. The CVSS 4.0 base score is 2.3, reflecting low severity due to high attack complexity and limited impact. No official remediation or patch has been disclosed by the vendor as of the publication date.

The vulnerability can lead to a partial denial of service condition in StorageGRID 11.5 under specific non-standard configurations. The impact is limited due to the requirement for attacker control over the environment and the high complexity of the attack. There is no indication of data compromise or full service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review their StorageGRID configurations to avoid non-standard setups that might expose this vulnerability. Monitor vendor communications for updates on patches or mitigations.