Active IQ OneCollect CVE-2026-22055

Exploitation requires an authenticated network connection to Active IQ OneCollect 2.7.3 with at least low-privilege credentials, as confirmed by the CVSS 4.0 vector (PR:L). The attacker must have network reachability to the OneCollect service (AV:N) and some level of application access - fully external, unauthenticated attackers are not the threat model here. No user interaction is required (UI:N) and no special attack conditions exist (AT:N). Limiting factors include: the mandatory low-privilege authentication prerequisite, which excludes fully anonymous external attackers; the restricted impact scope limited to AutoSupport operations (no system shell, no file system access indicated); and the absence of any public exploit code at time of analysis.

The vendor-assigned CVSS 4.0 score of 5.3 (Medium) accurately reflects a contained but real risk: no direct compromise of the vulnerable system, but unauthorized lateral reach into AutoSupport subsystems (SC:L). The network attack vector and low complexity (AV:N/AC:L/AT:N) mean exploitation is straightforward for any authenticated user on the network - no special conditions or privileges beyond a low-privilege account are required. The 'Authentication Bypass' tag is somewhat imprecise; the core issue is privilege escalation via embedded credentials, not bypassing authentication entirely. EPSS data is unavailable, and the vulnerability is not in the CISA KEV catalog, indicating no confirmed active exploitation. Real-world severity depends heavily on the sensitivity of AutoSupport data in a given environment and whether unauthorized AutoSupport submissions could leak sensitive configurations to NetApp or other endpoints. Organizations with strict data governance over AutoSupport content should treat this as a higher operational risk than the raw CVSS score implies.

An attacker with a low-privilege account - such as a compromised read-only service account or a malicious insider - authenticates to Active IQ OneCollect 2.7.3 over the network and leverages the hard-coded credentials embedded in the application to invoke AutoSupport operations outside their authorized scope. This could include triggering unsanctioned data collections, redirecting AutoSupport bundles, or accessing configuration telemetry not intended for their role. No public exploit code is currently identified, but the low attack complexity means exploitation requires minimal technical skill once the embedded credential values are extracted from the application binary or configuration.