NetApp StorageGRID CVE-2026-22058

Exploitation requires two specific prerequisites stated in the description: (1) network-level ability to communicate with the StorageGRID Grid Network on certain ports - the Grid Network is StorageGRID's internal inter-node network, which is typically segmented from general/client networks, so the attacker must already be able to reach it; and (2) 'product-specific knowledge' of how to form the unauthorized requests, which maps to the CVSS AT:P (attack requirement present) and AC:H metrics. Affected scope is StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher. No authentication is required once these conditions are met (PR:N). The limiting factors - required Grid Network reachability and specialized product knowledge - meaningfully reduce the realistic attacker population compared to the AV:N network rating, favoring post-compromise or insider scenarios over broad remote exploitation.

This is a genuine high-priority issue, though its real-world exploitability is more constrained than the 9.1 base score suggests in isolation. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) describes a network-reachable flaw requiring no authentication (PR:N) but carrying both high attack complexity (AC:H) and a present attack requirement (AT:P) - the latter aligns with the description's 'product-specific knowledge' and 'ability to communicate with the Grid Network on certain ports,' meaning the attacker needs internal network positioning and specialized knowledge rather than trivial internet-wide access. Impact is high to confidentiality and integrity (VC:H/VI:H) with no availability impact (VA:N) and no scope/subsequent-system change. The vuln.today 'act_now' decision label elevates urgency, so this should be treated as a near-term remediation priority. However, key corroborating signals are MISSING: no EPSS probability, no CISA KEV listing, and no POC reference are present in the input, so there is currently no evidence of active or imminent widespread exploitation - the urgency rests on the vendor-reported severity and the decision label, not on observed in-the-wild activity. The AV:N designation is somewhat in tension with the requirement to reach the internal Grid Network (typically a segmented back-end network), suggesting exploitation realistically depends on prior network access rather than pure internet exposure - verify network segmentation with NetApp guidance.

An attacker who has already gained a foothold on, or can route traffic to, the segmented StorageGRID Grid Network leverages product-specific knowledge to craft requests to specific service ports, bypassing authentication to issue unauthorized requests against grid services. Because exploitation requires both Grid Network reachability and specialized knowledge (reflected in AC:H/AT:P), it is more plausible as a post-compromise lateral-movement or insider action than as an opportunistic internet-facing attack. No public exploit identified at time of analysis.