# cve.now: Netapp

The newest entries naming Netapp as an affected vendor (up to 200), of 77 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-22060](https://cve.now/CVE-2026-22060.md): CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 6.9)
- [CVE-2026-22058](https://cve.now/CVE-2026-22058.md): CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 9.1)
- [CVE-2026-22063](https://cve.now/CVE-2026-22063.md): CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products (CVSS 6.0)
- [CVE-2026-22061](https://cve.now/CVE-2026-22061.md): CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident (CVSS 8.2)
- [CVE-2026-22056](https://cve.now/CVE-2026-22056.md): CVE-2026-22056 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 2.3)
- [CVE-2026-22049](https://cve.now/CVE-2026-22049.md): ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to th (CVSS 8.7)
- [CVE-2026-22055](https://cve.now/CVE-2026-22055.md): Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform (CVSS 5.3)
- [CVE-2026-22054](https://cve.now/CVE-2026-22054.md): Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to per (CVSS 5.3)
- [CVE-2026-22051](https://cve.now/CVE-2026-22051.md): StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerabili (CVSS 2.3)
- [CVE-2026-22052](https://cve.now/CVE-2026-22052.md): ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. (CVSS 5.3)
- [CVE-2026-22048](https://cve.now/CVE-2026-22048.md): StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Micro (CVSS 7.1)
- [CVE-2026-22050](https://cve.now/CVE-2026-22050.md): ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which (CVSS 6.9)
- [CVE-2025-26517](https://cve.now/CVE-2025-26517.md): CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 5.4)
- [CVE-2025-26516](https://cve.now/CVE-2025-26516.md): CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 5.3)
- [CVE-2025-26515](https://cve.now/CVE-2025-26515.md): CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 7.5)
- [CVE-2025-26514](https://cve.now/CVE-2025-26514.md): CVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 6.4)
- [CVE-2025-26513](https://cve.now/CVE-2025-26513.md): The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited c (CVSS 7.0)
- [CVE-2025-26512](https://cve.now/CVE-2025-26512.md): CVE-2025-26512 Privilege Escalation Vulnerability in SnapCenter (CVSS 9.9)
- [CVE-2025-26511](https://cve.now/CVE-2025-26511.md): Cassandra-Lucene-Index allows bypass of Cassandra RBAC (CVSS 8.8)
- [CVE-2024-21994](https://cve.now/CVE-2024-21994.md): CVE-2024-21994 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 4.3)
- [CVE-2024-21993](https://cve.now/CVE-2024-21993.md): Information Disclosure Vulnerability in SnapCenter (CVSS 5.7)
- [CVE-2024-21988](https://cve.now/CVE-2024-21988.md): CVE-2024-21988 SSH Cryptographic Implementation Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 5.3)
- [CVE-2024-21990](https://cve.now/CVE-2024-21990.md): Default Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utility (CVSS 5.4)
- [CVE-2024-21989](https://cve.now/CVE-2024-21989.md): Privilege Escalation Vulnerability in ONTAP Select Deploy administration utility (CVSS 8.1)
- [CVE-2024-21984](https://cve.now/CVE-2024-21984.md): Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 5.9)
- [CVE-2024-21983](https://cve.now/CVE-2024-21983.md): Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 6.5)
- [CVE-2024-21987](https://cve.now/CVE-2024-21987.md): Improper Authorization Vulnerability in SnapCenter (CVSS 5.4)
- [CVE-2023-27318](https://cve.now/CVE-2023-27318.md): Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 6.5)
- [CVE-2024-21985](https://cve.now/CVE-2024-21985.md): Privilege Escalation Vulnerability in ONTAP 9 (CVSS 7.6)
- [CVE-2024-21982](https://cve.now/CVE-2024-21982.md): CVE-2024-21982 Information Disclosure Vulnerability in ONTAP 9 (CVSS 4.8)
- [CVE-2023-27319](https://cve.now/CVE-2023-27319.md): CVE-2023-27319 Information Disclosure Vulnerability in ONTAP Mediator (CVSS 5.3)
- [CVE-2023-27317](https://cve.now/CVE-2023-27317.md): Information Disclosure Vulnerability in ONTAP 9 (CVSS 4.3)
- [CVE-2023-27316](https://cve.now/CVE-2023-27316.md): Privilege Escalation Vulnerability in SnapCenter (CVSS 8.8)
- [CVE-2023-27314](https://cve.now/CVE-2023-27314.md): Denial of Service Vulnerability in ONTAP 9 (CVSS 7.5)
- [CVE-2023-27313](https://cve.now/CVE-2023-27313.md): Privilege Escalation Vulnerability in SnapCenter (CVSS 8.3)
- [CVE-2023-27312](https://cve.now/CVE-2023-27312.md): Privilege Escalation Vulnerability in SnapCenter Plugin for VMware vSphere (CVSS 5.4)
- [CVE-2023-27315](https://cve.now/CVE-2023-27315.md): Information Disclosure Vulnerability in SnapGathers (CVSS 6.5)
- [CVE-2020-8573](https://cve.now/CVE-2020-8573.md): The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that (no CVSS)
- [CVE-2020-8571](https://cve.now/CVE-2020-8571.md): StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability w (no CVSS)
- [CVE-2019-17275](https://cve.now/CVE-2019-17275.md): OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers. (no CVSS)
- [CVE-2019-17274](https://cve.now/CVE-2019-17274.md): NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default a (no CVSS)
- [CVE-2019-17273](https://cve.now/CVE-2019-17273.md): E-Series SANtricity OS Controller Software version 11.60.0 is susceptible to a vulnerability which allows an attacker to cause a Denial of S (no CVSS)
- [CVE-2019-17272](https://cve.now/CVE-2019-17272.md): All versions of ONTAP Select Deploy administration utility are susceptible to a vulnerability which when successfully exploited could allow (no CVSS)
- [CVE-2019-5509](https://cve.now/CVE-2019-5509.md): ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when succe (no CVSS)
- [CVE-2019-5503](https://cve.now/CVE-2019-5503.md): OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker t (no CVSS)
- [CVE-2019-5498](https://cve.now/CVE-2019-5498.md): OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user. (no CVSS)
- [CVE-2019-5501](https://cve.now/CVE-2019-5501.md): Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account information to unauthenticated remote attackers (no CVSS)
- [CVE-2019-5493](https://cve.now/CVE-2019-5493.md): Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticate (no CVSS)
- [CVE-2019-5497](https://cve.now/CVE-2019-5497.md): NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that co (no CVSS)
- [CVE-2019-5496](https://cve.now/CVE-2019-5496.md): Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain s (no CVSS)
- [CVE-2019-5495](https://cve.now/CVE-2019-5495.md): OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which (no CVSS)
- [CVE-2019-5494](https://cve.now/CVE-2019-5494.md): OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attack (no CVSS)
- [CVE-2019-5492](https://cve.now/CVE-2019-5492.md): Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account information to an unauthenticated attacker. (no CVSS)
- [CVE-2019-5490](https://cve.now/CVE-2019-5490.md): Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled (no CVSS)
- [CVE-2018-5482](https://cve.now/CVE-2018-5482.md): NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmissi (no CVSS)
- [CVE-2017-15515](https://cve.now/CVE-2017-15515.md): NetApp SnapCenter Server prior to 4.0 is susceptible to cross site scripting vulnerability that could allow a privileged user to inject arbi (no CVSS)
- [CVE-2019-5491](https://cve.now/CVE-2019-5491.md): Clustered Data ONTAP versions prior to 9.1P15 and 9.3 prior to 9.3P7 are susceptible to a vulnerability which discloses sensitive informatio (no CVSS)
- [CVE-2018-5499](https://cve.now/CVE-2018-5499.md): ATTO FibreBridge 7500N firmware version 2.95 is susceptible to a vulnerability which allows attackers to cause a Denial of Service (DoS). (no CVSS)
- [CVE-2018-5498](https://cve.now/CVE-2018-5498.md): Clustered Data ONTAP versions 9.0 through 9.4 are susceptible to a vulnerability which allows remote authenticated attackers to cause a Deni (no CVSS)
- [CVE-2018-5497](https://cve.now/CVE-2018-5497.md): Clustered Data ONTAP versions prior to 9.1P16, 9.3P10 and 9.4P5 are susceptible to a vulnerability which discloses sensitive information to (no CVSS)
- [CVE-2018-5481](https://cve.now/CVE-2018-5481.md): OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances maki (no CVSS)
- [CVE-2018-5496](https://cve.now/CVE-2018-5496.md): Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unau (no CVSS)
- [CVE-2018-5495](https://cve.now/CVE-2018-5495.md): All StorageGRID Webscale versions are susceptible to a vulnerability which could permit an unauthenticated attacker to communicate with syst (no CVSS)
- [CVE-2018-5492](https://cve.now/CVE-2018-5492.md): NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution. (no CVSS)
- [CVE-2018-5490](https://cve.now/CVE-2018-5490.md): Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more (no CVSS)
- [CVE-2018-5489](https://cve.now/CVE-2018-5489.md): NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be res (no CVSS)
- [CVE-2017-7568](https://cve.now/CVE-2017-7568.md): NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authen (no CVSS)
- [CVE-2018-5488](https://cve.now/CVE-2018-5488.md): NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 1 (no CVSS)
- [CVE-2018-5487](https://cve.now/CVE-2018-5487.md): NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RM (no CVSS)
- [CVE-2018-5485](https://cve.now/CVE-2018-5485.md): NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege esc (no CVSS)
- [CVE-2018-5486](https://cve.now/CVE-2018-5486.md): NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauth (no CVSS)
- [CVE-2017-15519](https://cve.now/CVE-2017-15519.md): Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for N (no CVSS)
- [CVE-2017-15518](https://cve.now/CVE-2017-15518.md): All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account (no CVSS)
- [CVE-2016-6904](https://cve.now/CVE-2016-6904.md): Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. (no CVSS)
- [CVE-2017-15517](https://cve.now/CVE-2017-15517.md): AltaVault OST Plug-in versions prior to 1.2.2 may allow attackers to obtain sensitive information via unspecified vectors. (no CVSS)
- [CVE-2017-15516](https://cve.now/CVE-2017-15516.md): NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability which could be used t (no CVSS)
- [CVE-2017-11461](https://cve.now/CVE-2017-11461.md): NetApp OnCommand Unified Manager for 7-mode (core package) versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/netapp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.