6.0
Medium
CVE-2026-22063 CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products
Description
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NExploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- Interaction
- Passive
- Confidentiality
- High
- Integrity
- None
- Availability
- None
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ONTAP 9 9.18 | earliest → < 9.18.1 | 9.18.1 |
| StorageGRID (formerly StorageGRID Webscale) 12.2 | earliest → 12.2.0 | No fix stated |
| E-Series SANtricity OS Controller Software | 0 | No fix stated |
Other CVEs of ONTAP 9
The 8 CVEs of ONTAP 9 →
CVE-2026-22049
ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a…
8.7
High
CVE-2026-22052
ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability
5.3
Medium
CVE-2026-22050
ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to…
6.9
Medium
CVE-2024-21985
ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability…
7.6
High