Netapp Ontap vulnerabilities

• netapp e-series santricity os controller software, ontap 9, storagegrid (formerly storagegrid webscale) +2 more CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products CVE-2026-22063 6.0 MediumOctober 27, 2026
• netapp ontap, ontap 9 +1 more ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are... CVE-2026-22049 8.7 HighJuly 22, 2026
• netapp ontap, ontap 9 +1 more ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure... CVE-2026-22052 5.3 MediumMarch 4, 2026
• netapp ontap, ontap 9 +1 more ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking... CVE-2026-22050 6.9 MediumJanuary 12, 2026
• apache httpclient, apache software foundation httpcomponents, netapp ontap tools +2 more Apache HttpComponents: PSL (Public Suffix List) validation bypass CVE-2025-27820 Fix available 7.5 HighApril 24, 2025
• php, netapp ontap +1 more Stream HTTP wrapper truncates redirect location to 1024 bytes CVE-2025-1861 Fix available 6.3 MediumMarch 14, 2025
• php, netapp ontap +1 more Stream HTTP wrapper header check might omit basic auth header CVE-2025-1736 Fix available 6.3 MediumMarch 14, 2025
• php, netapp ontap +1 more Streams HTTP wrapper does not fail for headers with invalid name and no colon CVE-2025-1734 Fix available 6.3 MediumMarch 14, 2025
• openbsd openssh, debian linux, netapp active iq unified manager +15 more +17 more Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled CVE-2025-26465 Public exploitFix available 6.8 MediumFebruary 18, 2025
• gnome libxml2, netapp active iq unified manager, h300s firmware +8 more +10 more libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in... CVE-2025-24928 Fix available 7.8 HighFebruary 18, 2025
• gnome libxml2, netapp active iq unified manager, h300s firmware +8 more +10 more libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in... CVE-2024-56171 Fix available 7.8 HighFebruary 18, 2025
• gnu binutils, netapp active iq unified manager, ontap select deploy administration utility +2 more GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption CVE-2025-1181 Fix available 2.3 LowFebruary 11, 2025
• gnu binutils, netapp active iq unified manager, ontap select deploy administration utility +2 more GNU Binutils ld libbfd.c bfd_putl64 memory corruption CVE-2025-1178 Fix available 6.3 MediumFebruary 11, 2025
• curl, netapp bootstrap os, element software +32 more +34 more netrc and default credential leak CVE-2025-0167 Fix available 3.4 LowFebruary 5, 2025
• es iperf3, netapp hci compute node, ontap 9 +2 more iperf v3.17.1 was discovered to contain a segmentation violation via the... CVE-2024-53580 Fix available 7.5 HighDecember 18, 2024
• curl, netapp bootstrap os, h300s firmware +29 more +31 more netrc and redirect credential leak CVE-2024-11053 Fix available 3.4 LowDecember 11, 2024
• php, netapp ontap +1 more OOB access in ldap_escape CVE-2024-8932 Fix available 9.8 CriticalNovember 22, 2024
• gnome glib, debian linux, netapp active iq unified manager +31 more +33 more gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer... CVE-2024-52533 Fix available 9.8 CriticalNovember 11, 2024
• ruby rexml, netapp ontap tools +1 more REXML ReDoS vulnerability CVE-2024-49761 Fix available 6.6 MediumOctober 28, 2024
• apache commons io, netapp active iq unified manager, bluexp +5 more +7 more Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader CVE-2024-47554 Fix available 4.3 MediumOctober 3, 2024
• google protobuf, protocol buffers, google-protobuf [jruby gem] +8 more +10 more Stack overflow in Protocol Buffers Java Lite CVE-2024-7254 Fix available 8.7 HighSeptember 19, 2024
• curl, debian linux, netapp active iq unified manager +26 more +28 more OCSP stapling bypass with GnuTLS CVE-2024-8096 Fix available 6.5 MediumSeptember 11, 2024
• netapp 500f firmware, a250 firmware, active iq unified manager +22 more +24 more Possible denial of service in X.509 name checks CVE-2024-6119 Fix available EPSS 66.6% 7.5 HighSeptember 3, 2024
• apache tomcat, netapp ontap tools +1 more Apache Tomcat: Denial of Service CVE-2024-38286 Fix available 8.6 HighAugust 21, 2024
• certifi, certifi python-certifi, netapp management services for element software and netapp hci +2 more +4 more Certifi removes GLOBALTRUST root certificate CVE-2024-39689 Public exploitFix available 7.5 HighJuly 5, 2024
• apache http server, netapp ontap tools +1 more Apache HTTP Server: source code disclosure with handlers configured via AddType CVE-2024-39884 Fix available 6.2 MediumJuly 4, 2024
• apache tomcat, netapp ontap tools +1 more Apache Tomcat: HTTP/2 excess header handling DoS CVE-2024-34750 Fix available 7.5 HighJuly 3, 2024
• apache http server, netapp ontap +1 more Apache HTTP Server: mod_rewrite proxy handler substitution CVE-2024-39573 Fix available EPSS 35.4% 7.5 HighJuly 1, 2024
• apache http server, netapp clustered data ontap +1 more Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request CVE-2024-38477 Fix available 7.5 HighJuly 1, 2024
• apache http server, netapp clustered data ontap +1 more Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect CVE-2024-38476 Public exploitFix available EPSS 41.6% 9.8 CriticalJuly 1, 2024
• apache http server, netapp ontap 9, sonicwall sma 200 firmware +4 more +6 more Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. CVE-2024-38475 In KEVPublic exploitFix available EPSS 100.0% 9.1 CriticalJuly 1, 2024
• apache http server, netapp clustered data ontap +1 more Apache HTTP Server weakness with encoded question marks in backreferences CVE-2024-38474 Fix available 9.8 CriticalJuly 1, 2024
• apache http server, netapp ontap +1 more Apache HTTP Server proxy encoding problem CVE-2024-38473 Public exploitFix available EPSS 25.9% 8.1 HighJuly 1, 2024
• apache http server, netapp ontap +1 more Apache HTTP Server on WIndows UNC SSRF CVE-2024-38472 Public exploitFix available EPSS 69.5% 7.5 HighJuly 1, 2024
• apache http server, netapp ontap +1 more Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 CVE-2024-36387 Fix available 5.4 MediumJuly 1, 2024
• openbsd openssh, almalinux, amazon linux +71 more +73 more Openssh: regresshion - race condition in ssh allows rce/dos CVE-2024-6387 Public exploitFix available EPSS 99.5% 8.1 HighJuly 1, 2024
• bouncycastle bouncy castle for java, netapp active iq unified manager, bluexp +2 more +4 more Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") CVE-2024-30171 Fix available 5.9 MediumMay 7, 2024
• gnome glib, debian linux, fedoraproject fedora +7 more +9 more An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a... CVE-2024-34397 Fix available 5.2 MediumMay 7, 2024
• netapp ontap select deploy administration utility, clustered data ontap +1 more Default Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utility CVE-2024-21990 5.4 MediumApril 17, 2024
• netapp ontap select deploy administration utility Privilege Escalation Vulnerability in ONTAP Select Deploy administration utility CVE-2024-21989 8.1 HighApril 17, 2024
• debian linux, gnu glibc, netapp active iq unified manager +13 more +15 more The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer... CVE-2024-2961 Public exploitFix available EPSS 88.3% 7.3 HighApril 17, 2024
• openssl, debian linux, netapp 500f firmware +79 more +81 more Unbounded memory growth with session handling in TLSv1.3 CVE-2024-2511 Fix available EPSS 59.3% 5.9 MediumApril 8, 2024
• apache http server, apple macos, broadcom fabric operating system +4 more +6 more Apache HTTP Server: HTTP Response Splitting in multiple modules CVE-2024-24795 Fix available 6.3 MediumApril 4, 2024
• apache http server, apple macos, broadcom fabric operating system +4 more +6 more Apache HTTP Server: HTTP response splitting CVE-2023-38709 Public exploitFix available 7.3 HighApril 4, 2024
• curl, apple macos, netapp active iq unified manager +14 more +16 more QUIC certificate check bypass with wolfSSL CVE-2024-2379 Fix available 6.3 MediumMarch 27, 2024
• curl, apple macos, fedoraproject fedora +16 more +18 more HTTP/2 push headers memory-leak CVE-2024-2398 Fix available EPSS 36.1% 8.6 HighMarch 27, 2024
• curl, apple macos, fedoraproject fedora +12 more +14 more Usage of disabled protocol CVE-2024-2004 Fix available 3.5 LowMarch 27, 2024
• apache http server, fedoraproject fedora, netapp ontap +2 more Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames CVE-2024-27316 Public exploitFix available EPSS 88.8% 7.5 HighMarch 27, 2024
• apache commons configuration, fedoraproject fedora, netapp ontap tools +1 more +3 more Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() CVE-2024-29131 Fix available 7.3 HighMarch 21, 2024
• debian linux, linux kernel, netapp a150 firmware +11 more +13 more ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() CVE-2024-26641 Fix available 8.6 HighMarch 18, 2024
• Show olderLoading…