CVE-2026-22052

ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.

Score

CVSS 4.0 5.3 Medium

Status

Analyzed - security-alert@netapp.com

Published

2026-03-05

Last modified

2026-03-06

Weaknesses

CWE-209

Affected products

• Ontap (Netapp)
• Ontap 9 (Netapp)

References

• https://security.netapp.com/advisory/NTAP-20260304-0001