Threat database

NetApp Trident versions 25.02.1 through 26.06.1 contain a vulnerability where sensitive information such as LUKS passphrases or SMB Active Directory credentials may be inserted into debug logs. This issue allows an authenticated attacker with access to these debug logs to view this sensitive data. The vulnerability is identified as CWE-215 and has a high severity rating with a CVSS score of 8.2.

NetApp StorageGRID version 11.5 in certain non-standard configurations is vulnerable to a denial of service condition due to allocation of file descriptors or handles without limits or throttling. An attacker with some control over the environment could exploit this to cause a partial denial of service. The vulnerability has a low severity score and no known exploits in the wild. No official patch or remediation guidance has been provided yet.

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.

NETAPP Active IQ OneCollect version 2.7.3 contains hard-coded credentials that may allow an authenticated user with low privileges to perform unauthorized AutoSupport operations. This vulnerability is identified as CVE-2026-22055 and has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance has been provided yet by the vendor. The issue specifically affects version 2.7.3 of Active IQ OneCollect.

NETAPP Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated user with low privileges to perform unauthorized AutoSupport operations. This vulnerability is identified as CVE-2026-22054 and has a medium severity rating with a CVSS 4.0 score of 5.3. No official patch or remediation guidance has been provided by the vendor as of the publication date.

NETAPP StorageGRID versions prior to 11.9.0.13 and 12.0.0.6 have an information disclosure vulnerability (CVE-2026-22051). An authenticated user with low privileges can execute arbitrary metrics queries, potentially accessing unauthorized metric data. The vulnerability has a low severity with a CVSS score of 2.3, indicating limited impact.

ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources.

CVE-2026-22050 is a medium severity vulnerability affecting NetApp ONTAP 9 versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 when snapshot locking is enabled. It allows a privileged remote attacker to set the snapshot expiry time to none, potentially causing snapshots to persist indefinitely.

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful exploit could allow an unauthorized authenticated attacker to discover Grid node names and IP addresses or modify Storage Grades.

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated attacker to cause a Denial of Service on the Admin node.

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without Single Sign-on enabled are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an unauthenticated attacker to change the password of any Grid Manager or Tenant Manager non-federated user.

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Reflected Cross-Site Scripting vulnerability. Successful exploit could allow an attacker to view or modify configuration settings or add or modify user accounts but requires the attacker to know specific information about the target instance and then trick a privileged user into clicking a specially crafted link.

The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local user to escalate their privileges.

SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed.

Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow authenticated Cassandra users to remotely bypass RBAC and escalate their privileges.

ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS).