# NetApp vulnerabilities Source: https://junglewise.ai/threats/vendors/netapp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/netapp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 21 vulnerabilities in NetApp: 0 in the last 7 days and 5 in the last 90 days, 5 of them critical and 3 exploited in the wild. The most recent, CVE-2026-22060, was published on 3 November 2026. 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 13 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 5 - All time: 21 (5 critical, 3 exploited in the wild) ## About NetApp An American hybrid cloud data services and data management company. ## Latest NetApp vulnerabilities - [CVE-2026-22060: NetApp StorageGRID unauthenticated API access](https://junglewise.ai/threats/cve-2026-22060-all-versions-of-storagegrid-formerly-storagegrid-webscale-in) (info, published 3 Nov 2026) - [CVE-2026-22058: NetApp StorageGRID unauthorized request via Grid Network](https://junglewise.ai/threats/cve-2026-22058-storagegrid-formerly-storagegrid-webscale-versions-11-3-and) (info, published 3 Nov 2026) - [CVE-2026-22063: eMudhra intermediate CA certificate private key compromise](https://junglewise.ai/threats/cve-2026-22063-the-private-keys-of-eight-emudhra-intermediate-ca-certificates) (info, published 27 Oct 2026) - [CVE-2026-22061: NetApp Trident credential exposure in debug logs](https://junglewise.ai/threats/cve-2026-22061-trident-versions-v25-02-1-through-v26-06-1-are-susceptible-to-a) (info, published 9 Oct 2026) - [CVE-2026-22056: NetApp StorageGRID denial of service in non-standard configuration](https://junglewise.ai/threats/cve-2026-22056-netapp-storagegrid-denial-of-service-in-non-standard) (info, published 28 Aug 2026) - [CVE-2026-22049: NetApp ONTAP MFA bypass in WebAuthn](https://junglewise.ai/threats/cve-2026-22049-netapp-ontap-mfa-bypass-in-webauthn) (info, CVSS 8.7, published 22 Jul 2026) - [CVE-2026-22055: NetApp Active IQ OneCollect hard-coded credentials in AutoSupport](https://junglewise.ai/threats/cve-2026-22055-netapp-active-iq-onecollect-hard-coded-credentials-in-autosupport) (info, CVSS 5.3, published 3 Jun 2026) - [CVE-2026-22054: NetApp Active IQ Config Advisor hard-coded credentials in AutoSupport](https://junglewise.ai/threats/cve-2026-22054-netapp-active-iq-config-advisor-hard-coded-credentials-in) (info, CVSS 5.3, published 3 Jun 2026) - [CVE-2026-22051: NetApp StorageGRID information disclosure via arbitrary metrics queries](https://junglewise.ai/threats/cve-2026-22051-netapp-storagegrid-information-disclosure-via-arbitrary-metrics) (medium, CVSS 4.3, published 20 Apr 2026) - [CVE-2024-54085: AMI MegaRAC SPx authentication bypass in Redfish Host Interface](https://junglewise.ai/threats/cve-2024-54085-ami-megarac-spx-authentication-bypass-in-redfish-host-interface) (critical, exploited in the wild, CVSS 10, published 25 Jun 2025) - [CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability](https://junglewise.ai/threats/cve-2024-38475-apache-http-server-improper-escaping-of-output-vulnerability) (critical, exploited in the wild, CVSS 9.1, published 1 May 2025) - [CVE-2025-0411: 7-Zip Mark of the Web Bypass Vulnerability](https://junglewise.ai/threats/cve-2025-0411-7-zip-mark-of-the-web-bypass-vulnerability) (critical, exploited in the wild, CVSS 7, published 6 Feb 2025) - [CVE-2024-3447: QEMU heap buffer overflow in SDHCI device emulation](https://junglewise.ai/threats/cve-2024-3447-qemu-heap-buffer-overflow-in-sdhci-device-emulation) (medium, CVSS 6, published 14 Nov 2024) - [CVE-2024-33601: GNU glibc denial of service in nscd netgroup cache](https://junglewise.ai/threats/cve-2024-33601-gnu-glibc-denial-of-service-in-nscd-netgroup-cache) (high, CVSS 7.3, published 6 May 2024) - [CVE-2024-33600: GNU glibc null pointer dereference in nscd netgroup cache](https://junglewise.ai/threats/cve-2024-33600-gnu-glibc-null-pointer-dereference-in-nscd-netgroup-cache) (medium, CVSS 5.9, published 6 May 2024) - [CVE-2024-33599: GNU glibc nscd stack-based buffer overflow in netgroup cache](https://junglewise.ai/threats/cve-2024-33599-gnu-glibc-nscd-stack-based-buffer-overflow-in-netgroup-cache) (high, CVSS 8.1, published 6 May 2024) - [CVE-2023-28531: OpenSSH ssh-add destination constraint bypass for smartcard keys](https://junglewise.ai/threats/cve-2023-28531-openssh-ssh-add-destination-constraint-bypass-for-smartcard-keys) (critical, CVSS 9.8, published 17 Mar 2023) - [CVE-2022-43945: Linux Kernel NFSD buffer overflow in RPC handling](https://junglewise.ai/threats/cve-2022-43945-linux-kernel-nfsd-buffer-overflow-in-rpc-handling) (high, CVSS 7.5, published 4 Nov 2022) - [CVE-2021-38202: Linux Kernel out-of-bounds read in nfsd tracepoint](https://junglewise.ai/threats/cve-2021-38202-linux-kernel-out-of-bounds-read-in-nfsd-tracepoint) (high, CVSS 7.5, published 8 Aug 2021) - [CVE-2016-10160: PHP off-by-one error in phar_parse_pharfile](https://junglewise.ai/threats/cve-2016-10160-php-off-by-one-error-in-phar-parse-pharfile) (critical, CVSS 9.8, published 24 Jan 2017) - [CVE-1999-0016: Multiple Vendors TCP/IP Land denial of service](https://junglewise.ai/threats/cve-1999-0016-multiple-vendors-tcp-ip-land-denial-of-service) (medium, CVSS 5, published 1 Dec 1997) ## Most severe NetApp vulnerabilities - [CVE-2024-54085: AMI MegaRAC SPx authentication bypass in Redfish Host Interface](https://junglewise.ai/threats/cve-2024-54085-ami-megarac-spx-authentication-bypass-in-redfish-host-interface) (critical, exploited in the wild, CVSS 10, published 25 Jun 2025) - [CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability](https://junglewise.ai/threats/cve-2024-38475-apache-http-server-improper-escaping-of-output-vulnerability) (critical, exploited in the wild, CVSS 9.1, published 1 May 2025) - [CVE-2025-0411: 7-Zip Mark of the Web Bypass Vulnerability](https://junglewise.ai/threats/cve-2025-0411-7-zip-mark-of-the-web-bypass-vulnerability) (critical, exploited in the wild, CVSS 7, published 6 Feb 2025) - [CVE-2023-28531: OpenSSH ssh-add destination constraint bypass for smartcard keys](https://junglewise.ai/threats/cve-2023-28531-openssh-ssh-add-destination-constraint-bypass-for-smartcard-keys) (critical, CVSS 9.8, published 17 Mar 2023) - [CVE-2016-10160: PHP off-by-one error in phar_parse_pharfile](https://junglewise.ai/threats/cve-2016-10160-php-off-by-one-error-in-phar-parse-pharfile) (critical, CVSS 9.8, published 24 Jan 2017) - [CVE-2024-33599: GNU glibc nscd stack-based buffer overflow in netgroup cache](https://junglewise.ai/threats/cve-2024-33599-gnu-glibc-nscd-stack-based-buffer-overflow-in-netgroup-cache) (high, CVSS 8.1, published 6 May 2024) - [CVE-2022-43945: Linux Kernel NFSD buffer overflow in RPC handling](https://junglewise.ai/threats/cve-2022-43945-linux-kernel-nfsd-buffer-overflow-in-rpc-handling) (high, CVSS 7.5, published 4 Nov 2022) - [CVE-2021-38202: Linux Kernel out-of-bounds read in nfsd tracepoint](https://junglewise.ai/threats/cve-2021-38202-linux-kernel-out-of-bounds-read-in-nfsd-tracepoint) (high, CVSS 7.5, published 8 Aug 2021) - [CVE-2024-33601: GNU glibc denial of service in nscd netgroup cache](https://junglewise.ai/threats/cve-2024-33601-gnu-glibc-denial-of-service-in-nscd-netgroup-cache) (high, CVSS 7.3, published 6 May 2024) - [CVE-2024-3447: QEMU heap buffer overflow in SDHCI device emulation](https://junglewise.ai/threats/cve-2024-3447-qemu-heap-buffer-overflow-in-sdhci-device-emulation) (medium, CVSS 6, published 14 Nov 2024) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up 200% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## NetApp technologies - [NetApp H300S Firmware](https://junglewise.ai/threats/technologies/h300s-firmware): 5 vulnerabilities - [NetApp H410C Firmware](https://junglewise.ai/threats/technologies/h410c-firmware): 5 vulnerabilities - [NetApp H410S Firmware](https://junglewise.ai/threats/technologies/h410s-firmware): 5 vulnerabilities - [NetApp H500S Firmware](https://junglewise.ai/threats/technologies/h500s-firmware): 5 vulnerabilities - [NetApp H700S Firmware](https://junglewise.ai/threats/technologies/h700s-firmware): 5 vulnerabilities - [NetApp Hci Bootstrap Os](https://junglewise.ai/threats/technologies/hci-bootstrap-os): 5 vulnerabilities - [NetApp StorageGRID](https://junglewise.ai/threats/technologies/storagegrid): 4 vulnerabilities - [NetApp H300s](https://junglewise.ai/threats/technologies/h300s): 3 vulnerabilities - [NetApp H410c](https://junglewise.ai/threats/technologies/h410c): 3 vulnerabilities - [NetApp H410s](https://junglewise.ai/threats/technologies/h410s): 3 vulnerabilities - [NetApp H500s](https://junglewise.ai/threats/technologies/h500s): 3 vulnerabilities - [NetApp H700s](https://junglewise.ai/threats/technologies/h700s): 3 vulnerabilities - [NetApp HCI Compute Node](https://junglewise.ai/threats/technologies/hci-compute-node): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "NetApp vulnerabilities", https://junglewise.ai/threats/vendors/netapp, 11 November 2026.