EUVD-2026-47770Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin auth with low-complexity bypass; PR:L because valid credentials are required, and successful admin access yields full C/I/A impact on the storage system.
Primary rating from Vendor (netapp).
CVSS VectorVendor: netapp
Lifecycle Timeline
3DescriptionCVE.org
ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.
AnalysisAI
MFA bypass in NetApp ONTAP 9.16.1 and later occurs when WebAuthn multi-factor authentication is configured, stemming from improper handling of the WebAuthn Relying Party ID. An attacker who already holds valid credentials can defeat the second authentication factor and gain full administrative access to the storage management plane. No public exploit identified at time of analysis; the flaw is vendor-reported by NetApp and not listed in CISA KEV.
Technical ContextAI
The vulnerability lives in ONTAP's implementation of the WebAuthn/FIDO2 standard, specifically its validation of the Relying Party ID (RP ID). In WebAuthn, the RP ID scopes a credential to a particular origin/domain; the authenticator and server are supposed to strictly bind assertions to the correct RP ID so a credential cannot be replayed or accepted for an unintended party. Weak or missing RP ID validation is an improper-authentication weakness (CWE-287, related to CWE-863 incorrect authorization and CWE-1390 weak authentication), allowing a WebAuthn assertion to satisfy the MFA check when it should not. The affected component is the ONTAP administrative authentication service on the NetApp ONTAP 9 storage OS (cpe:2.3:a:netapp:ontap_9), and only deployments that have explicitly enabled WebAuthn MFA are in scope. No CWE was assigned in the source data; the root-cause class above is inferred from the description.
RemediationAI
Apply the fixed ONTAP release identified in NetApp advisory NTAP-20260722-0001 (https://security.netapp.com/advisory/NTAP-20260722-0001/); an exact patched version string was not present in the supplied data, so confirm the fixed build directly from that advisory - Patch available per vendor advisory. As an interim compensating control where patching cannot be immediately scheduled, consider temporarily reverting affected admin accounts to a different MFA method (for example TOTP or hardware OTP) instead of WebAuthn until the fix is applied, since the flaw is specific to the WebAuthn RP ID path - the trade-off is a short-term change to the admin login experience. Additionally, restrict network access to the ONTAP management LIF/administrative interfaces to a trusted management network or jump hosts, and tighten credential hygiene (rotate and monitor privileged accounts) to reduce the chance an attacker holds the valid credentials this bypass requires; the trade-off is added operational friction for legitimate administrators.
iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function. Rated hig
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. Rated high se
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in w
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c. Rated medium severity (CVSS 5.3), t
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may atte
curl before 7.86.0 has a double free. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no aut
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today