E Series Santricity Os Controller Software
Monthly
NetApp ONTAP 9 (before 9.18.1), StorageGRID (through 12.2.0) and affected E-Series SANtricity OS Controller Software builds can still trust eight eMudhra intermediate CA certificates whose private keys were compromised and which eMudhra revoked on October 18, 2026. An attacker holding one of those compromised intermediate keys and positioned to intercept traffic could mint a certificate that chains to a trusted-but-revoked intermediate and have it accepted by the product, exposing confidential data (confidentiality-only impact). The assessed path is non-trivial - it requires an interception position, a victim connecting to the forged endpoint, and AC:H - and no public exploit code has been identified at time of analysis. NetApp tracks the required trust-store changes under this CVE and has published an advisory with vendor-provided updates.
NetApp ONTAP 9 (before 9.18.1), StorageGRID (through 12.2.0) and affected E-Series SANtricity OS Controller Software builds can still trust eight eMudhra intermediate CA certificates whose private keys were compromised and which eMudhra revoked on October 18, 2026. An attacker holding one of those compromised intermediate keys and positioned to intercept traffic could mint a certificate that chains to a trusted-but-revoked intermediate and have it accepted by the product, exposing confidential data (confidentiality-only impact). The assessed path is non-trivial - it requires an interception position, a victim connecting to the forged endpoint, and AC:H - and no public exploit code has been identified at time of analysis. NetApp tracks the required trust-store changes under this CVE and has published an advisory with vendor-provided updates.