Active IQ Config Advisor CVE-2026-22054

The attacker must hold a valid authenticated account with low privileges on the system running Active IQ Config Advisor 6.7.3 (confirmed by CVSS PR:L). Network access to the vulnerable instance is required (AV:N), and no additional attack requirements or user interaction are needed (AT:N/UI:N). Exploitation is limited to version 6.7.3 as explicitly stated in the advisory - other versions are not confirmed affected. The hard-coded credentials specifically enable unauthorized AutoSupport operations; exploitation is scoped to that functionality and does not grant broader system access on the vulnerable host (VC:N/VI:N/VA:N). Unauthenticated exploitation is not possible: a valid account within the application is a firm prerequisite.

The CVSS 4.0 base score of 5.3 (Medium) reflects a constrained but real risk profile. The vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-reachable exploitation with low complexity and no user interaction, but requires low-privilege authentication - meaning anonymous exploitation is not possible. The scope of impact is narrow: subsequent system confidentiality is rated Low (SC:L), with no integrity or availability impacts on either the vulnerable or downstream systems. This limits the blast radius primarily to unauthorized AutoSupport data submissions or access to support-related telemetry channels. EPSS data is not provided in the source intelligence, so exploitation probability cannot be quantified. No KEV listing and no public exploit code were identified, suggesting this is not under active widespread exploitation. The tag 'Authentication Bypass' is somewhat misleading - the vulnerability does not bypass authentication into Config Advisor itself, but rather bypasses authorization controls within the application using embedded static credentials. Real-world risk is moderate for environments where low-privileged users should not have access to AutoSupport operations, particularly in regulated industries where data sent to vendor support infrastructure is subject to compliance requirements.

An attacker with a low-privilege account on a system running Active IQ Config Advisor 6.7.3 extracts the hard-coded credentials from the application binary or configuration files through local file access or reverse engineering. Using those credentials, the attacker submits crafted or unauthorized AutoSupport bundles to NetApp support infrastructure, potentially exfiltrating configuration data or polluting support telemetry. No public exploit code exists at time of analysis, so exploitation currently requires manual credential extraction.