NetApp StorageGRID CVE-2026-22060

No special conditions - remote unauthenticated exploitation against default and common configurations of NetApp StorageGRID (formerly StorageGRID Webscale), as the description explicitly states these configurations are affected and the CVSS vector is AV:N/AC:L/PR:N/UI:N. The practical limiting factor is scope, not prerequisites: the attacker can only reach a limited set of APIs intended for internal grid use, and impact is bounded to LOW confidentiality and LOW integrity (VA:N, no availability impact). Exposure further depends on the attacker having network reachability to grid nodes, so segmentation that keeps internal grid API ports off untrusted networks materially reduces real-world exposure.

This is a moderate-severity information-disclosure/limited-access issue, not a drop-everything emergency, but the vendor-assigned priority of this_month means it should be remediated on a near-term schedule rather than deferred. The NetApp CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, base 6.9) indicates a network-reachable, low-complexity, unauthenticated flaw with no user interaction, but the impact is explicitly scoped as LOW to both confidentiality and integrity on the vulnerable system and LOW to a subsequent system - the attacker reaches only 'a limited set of APIs that are intended for use within the grid,' not full administrative control. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit or PoC reference is present, so this is no public exploit identified at time of analysis. The signals are internally consistent (unauthenticated network vector with deliberately limited impact), so there is no CVSS-vs-description conflict to flag; the main caveat is simply that EPSS and any real-world exploitation telemetry are absent, so the priority rests on the vendor's own this_month decision and the easy, unauthenticated reachability rather than on observed attacker activity.

An attacker with network reachability to a StorageGRID node sends unauthenticated requests to internal-only grid APIs that are exposed in default and common configurations, retrieving information or performing limited actions those APIs were never meant to allow from outside the grid. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required, though the gained access and resulting impact are limited (VC:L/VI:L). No public exploit or PoC reference is present in the supplied data.