Ontap 9 (Netapp) - vulnerabilities (CVEs)

9 CVEs, 1 in the last 30 days, 5 known versions, newest CVE from 2026-10-27. Vendor: Netapp.

CVEs of Ontap 9

• CVE-2026-22063 - CVSS 6 (medium), 2026-10-27: The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October…
• CVE-2026-22049 - CVSS 8.8 (high), 2026-07-22: ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID…
• CVE-2026-22052 - CVSS 5.3 (medium), 2026-03-05: ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an…
• CVE-2026-22050 - CVSS 6.9 (medium), 2026-01-12: ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a…
• CVE-2024-53580 - CVSS 7.5 (high), 2024-12-18: iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.
• CVE-2024-6119 - CVSS 7.5 (high), 2024-09-03: Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address…
• CVE-2024-38475 - CVSS 9.1 (critical), 2024-07-01: Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted…
• CVE-2024-26461 - CVSS 7.5 (high), 2024-02-29: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
• CVE-2024-26458 - CVSS 5.3 (medium), 2024-02-29: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
• CVE-2024-21985 - CVSS 7.6 (high), 2024-01-26: ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user…
• CVE-2024-21982 - CVSS 6.5 (medium), 2024-01-12: ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to…
• CVE-2023-27317 - CVSS 4.6 (medium), 2023-12-15: ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked…
• CVE-2023-27314 - CVSS 7.5 (high), 2023-10-12: ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote…
• CVE-2023-27535 - CVSS 5.9 (medium), 2023-03-30: An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during…
• CVE-2022-3996 - CVSS 7.5 (high), 2022-12-13: If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some…
• CVE-2022-42915 - CVSS 8.1 (high), 2022-10-29: curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote…
• CVE-2022-27780 - CVSS 7.5 (high), 2022-06-02: The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe…