NetApp ONTAP CVE-2026-22049

Exploitation requires two concrete prerequisites drawn from the description: the target must be running ONTAP 9.16.1 or higher AND must have WebAuthn multi-factor authentication explicitly configured - deployments without WebAuthn MFA are not exploitable. The attacker must also already possess valid login credentials for an account (PR:L), so this is a second-factor bypass, not an unauthenticated break-in. Limiting factors that reduce realistic risk: the non-default requirement that WebAuthn MFA be enabled, the need for pre-existing valid credentials, and network reachability to the ONTAP administrative interface; no user interaction is required (UI:N).

The NetApp-supplied CVSS 4.0 score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, indicating network-reachable, low-complexity exploitation that requires low privileges (valid credentials) and no user interaction, yielding high confidentiality, integrity and availability impact on the vulnerable system with no scope change. This is internally consistent with the description: the attacker must already possess valid credentials (PR:L), so this is a factor-bypass rather than a fully unauthenticated compromise - the real-world threat is highest where credentials are phishable or already stolen and MFA is the last line of defense. No EPSS score was provided, so exploitation probability cannot be quantified. The flaw is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation. Net priority: a genuine, credible High that undermines the specific control (MFA) organizations deploy to contain credential theft, but its impact is gated by the attacker first obtaining valid credentials and the target having WebAuthn MFA configured, which narrows the exposed population.

An attacker who has phished or otherwise obtained a valid ONTAP administrator's username and password connects to the ONTAP management interface over the network. Because WebAuthn Relying Party ID validation is flawed, the attacker manipulates the WebAuthn assertion/RP ID handling to satisfy the MFA step without possessing the legitimate hardware authenticator, completing login as the administrator. No public POC is currently referenced, and success depends on the target having WebAuthn MFA configured.