CVE-2026-22049

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.

Score

CVSS 3.1 8.8 High

Status

Analyzed - security-alert@netapp.com

Published

2026-07-22

Last modified

2026-10-24

Weaknesses

CWE-288

Affected products

• Ontap (Netapp)
• Ontap 9 (Netapp)

References

• https://security.netapp.com/advisory/NTAP-20260722-0001/