NetApp StorageGRID CVE-2026-22056

Exploitation is gated on two explicit conditions stated by the vendor: StorageGRID must be version 11.5 or higher, and the system must be operating in a non-standard configuration under a specific scenario - standard deployments are not affected. The CVSS 4.0 vector confirms that the attacker must hold low-privilege authenticated access (PR:L) and that both high attack complexity (AC:H) and specific preconditions (AT:P) must be satisfied simultaneously. Exploitation is further limited to partial availability impact on the vulnerable StorageGRID system only, with no confidentiality impact (VC:N), no integrity impact (VI:N), and no effect on subsequent or adjacent systems (SC:N/SI:N/SA:N). The non-standard configuration requirement is the dominant limiting factor: without it, the vulnerable code path cannot be reached.

The overall risk is genuinely low and difficult to prioritize above routine maintenance for most operators. The CVSS 4.0 score of 2.3 is well-grounded: network reachability (AV:N) is offset by high attack complexity (AC:H), mandatory preconditions (AT:P), a required authentication level (PR:L), and an impact ceiling of partial availability degradation (VA:L) with no confidentiality or integrity consequence and no lateral scope change. No EPSS score is available for this CVE at time of analysis, but the constrained exploitation model suggests an exploitation probability consistent with a low-severity, non-default-configuration flaw. The vulnerability carries no CISA KEV listing and no identified public exploit code, so even a mid-sized enterprise storage team running standard StorageGRID configurations faces no realistic exposure. The only scenario that elevates concern is an environment that has knowingly or inadvertently drifted into a non-standard configuration and grants authenticated access to untrusted parties - a combination that should already be addressed by baseline access controls.

An authenticated user with low-privilege access and some ability to influence StorageGRID's operating environment - such as submitting workloads that stress a specific non-standard configuration parameter - triggers the CWE-774 resource exhaustion flaw, causing the node to fail to release or cap handle allocations. Sustained triggering degrades storage availability for other users and workloads sharing the affected node. No public exploit code exists, and the high attack complexity and precondition requirements mean this scenario requires targeted, environment-specific knowledge rather than generic tooling.