Storagegrid Formerly Storagegrid Webscale
Monthly
NetApp StorageGRID (formerly StorageGRID Webscale) 11.3 and later permits unauthorized requests to be issued against the product by a remote party that can reach the Grid Network on specific ports, with no authentication needed once reachability is established; the CVSS:4.0 vector rates it 9.1 with high confidentiality and integrity impact but no availability impact. Exploitation is not trivial: it demands both access to the Grid Network - StorageGRID's internal inter-node network, normally segmented away from client and general-purpose networks - and product-specific knowledge of how to construct the malicious requests, which is captured by the AC:H and AT:P metrics and makes insider or post-compromise scenarios more plausible than broad internet-facing attacks. The issue is tagged for immediate action (act_now) by vuln.today and NetApp published advisory NTAP-20261103-0001; no public exploit code or CISA KEV entry was identified in the supplied data.
Unauthenticated remote access to internal-use APIs in NetApp StorageGRID (formerly StorageGRID Webscale) exposes a limited set of grid-internal interfaces across all versions in default and common configurations, yielding low confidentiality and low integrity impact with no availability impact. The CVSS 4.0 score is 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N), and the vendor-set priority is this_month, so near-term remediation is appropriate rather than emergency response. No public exploit identified at time of analysis.
NetApp ONTAP 9 (before 9.18.1), StorageGRID (through 12.2.0) and affected E-Series SANtricity OS Controller Software builds can still trust eight eMudhra intermediate CA certificates whose private keys were compromised and which eMudhra revoked on October 18, 2026. An attacker holding one of those compromised intermediate keys and positioned to intercept traffic could mint a certificate that chains to a trusted-but-revoked intermediate and have it accepted by the product, exposing confidential data (confidentiality-only impact). The assessed path is non-trivial - it requires an interception position, a victim connecting to the forged endpoint, and AC:H - and no public exploit code has been identified at time of analysis. NetApp tracks the required trust-store changes under this CVE and has published an advisory with vendor-provided updates.
StorageGRID versions before 11.9.0.13 and 12.0.0.6 allow authenticated attackers with low privileges to execute arbitrary metrics queries, exposing metric data they lack authorization to access. The vulnerability requires low-privilege authentication and specific timing conditions but poses direct information disclosure risk in multi-tenant or role-restricted deployments where metric visibility should be compartmentalized.
NetApp StorageGRID (formerly StorageGRID Webscale) 11.3 and later permits unauthorized requests to be issued against the product by a remote party that can reach the Grid Network on specific ports, with no authentication needed once reachability is established; the CVSS:4.0 vector rates it 9.1 with high confidentiality and integrity impact but no availability impact. Exploitation is not trivial: it demands both access to the Grid Network - StorageGRID's internal inter-node network, normally segmented away from client and general-purpose networks - and product-specific knowledge of how to construct the malicious requests, which is captured by the AC:H and AT:P metrics and makes insider or post-compromise scenarios more plausible than broad internet-facing attacks. The issue is tagged for immediate action (act_now) by vuln.today and NetApp published advisory NTAP-20261103-0001; no public exploit code or CISA KEV entry was identified in the supplied data.
Unauthenticated remote access to internal-use APIs in NetApp StorageGRID (formerly StorageGRID Webscale) exposes a limited set of grid-internal interfaces across all versions in default and common configurations, yielding low confidentiality and low integrity impact with no availability impact. The CVSS 4.0 score is 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N), and the vendor-set priority is this_month, so near-term remediation is appropriate rather than emergency response. No public exploit identified at time of analysis.
NetApp ONTAP 9 (before 9.18.1), StorageGRID (through 12.2.0) and affected E-Series SANtricity OS Controller Software builds can still trust eight eMudhra intermediate CA certificates whose private keys were compromised and which eMudhra revoked on October 18, 2026. An attacker holding one of those compromised intermediate keys and positioned to intercept traffic could mint a certificate that chains to a trusted-but-revoked intermediate and have it accepted by the product, exposing confidential data (confidentiality-only impact). The assessed path is non-trivial - it requires an interception position, a victim connecting to the forged endpoint, and AC:H - and no public exploit code has been identified at time of analysis. NetApp tracks the required trust-store changes under this CVE and has published an advisory with vendor-provided updates.
StorageGRID versions before 11.9.0.13 and 12.0.0.6 allow authenticated attackers with low privileges to execute arbitrary metrics queries, exposing metric data they lack authorization to access. The vulnerability requires low-privilege authentication and specific timing conditions but poses direct information disclosure risk in multi-tenant or role-restricted deployments where metric visibility should be compartmentalized.