NetApp ONTAP CVE-2026-22063

Exploitation requires that the NetApp product (ONTAP before 9.18.1, StorageGRID ≤12.2.0, or an affected E-Series SANtricity OS controller build) still trusts one of the eight revoked eMudhra intermediate CA certificates, AND that the attacker possesses one of the corresponding compromised intermediate CA private keys to mint a forged, chain-valid certificate. Concrete limiting factors: the attacker must occupy a man-in-the-middle / interception position (reflected by AT:P), the victim must passively interact by connecting and accepting the forged certificate (UI:P), and the overall path is non-trivial (AC:H), which is why this trends toward targeted abuse rather than default-config remote exploitation. Impact is confidentiality-only (VC:H, VI:N, VA:N). Installing the vendor-provided update, which removes trust in the revoked eMudhra intermediates, is the remediation per the NetApp advisory.

This is a trust/certificate issue rather than a software flaw: eight eMudhra intermediate CA private keys were compromised and revoked on October 18, 2026, and CVE-2026-22063 tracks the resulting trust changes in NetApp ONTAP, StorageGRID, and E-Series SANtricity. The supplied CVSS 4.0 score of 6.0 (medium) reflects a confidentiality-only impact (VC:H/VI:N/VA:N) reachable over the network (AV:N) but gated by high attack complexity (AC:H), a present attack requirement (AT:P), and required passive user interaction (UI:P) - so despite PR:N, practical exploitation is constrained, not turnkey. No EPSS score is provided in the input, there is no CISA KEV listing, and no PoC or exploit reference is supplied, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now or emergency), consistent with a moderate, patch-this-cycle priority rather than a widespread active-exploitation emergency. Key limitation to note explicitly: real-world exploitation hinges on an attacker actually possessing the compromised eMudhra key material and holding a man-in-the-middle position, which points to targeted rather than opportunistic abuse. EPSS is missing and cannot be cross-referenced.

An attacker holding one of the eight compromised eMudhra intermediate CA private keys forges a TLS certificate that a NetApp product still trusts, then positions themselves between a victim and the service to intercept a confidential session. Because the certificate chains to a (pre-revocation) trusted eMudhra intermediate, the victim's client accepts it and sensitive data is exposed. No public exploit is identified at time of analysis, and the attack requires both the stolen key material and a man-in-the-middle position plus victim interaction (AC:H, AT:P, UI:P).