6.0 Medium

CVE-2026-22063 CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products

Description

The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: None
Interaction: Passive
Confidentiality: High
Integrity: None
Availability: None
Confidentiality of other systems: None
Integrity of other systems: None
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
ONTAP 9 9.18	earliest → < 9.18.1	9.18.1
StorageGRID (formerly StorageGRID Webscale) 12.2	earliest → 12.2.0	No fix stated
E-Series SANtricity OS Controller Software	0	No fix stated

References

security.netapp.com security.netapp.com

Timeline

Published October 27, 2026
Last modified November 4, 2026

The 8 CVEs of ONTAP 9 →

CVE-2026-22049 ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a… 8.7 High CVE-2026-22052 ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability 5.3 Medium CVE-2026-22050 ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to… 6.9 Medium CVE-2024-21985 ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability… 7.6 High

Track this CVE