Vulnerability-Lookup

CERTFR-2026-AVI-0238

Vulnerability from certfr_avis - Published: 2026-03-05 - Updated: 2026-03-05

Une vulnérabilité a été découverte dans NetApp ONTAP 9. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
NetApp	ONTAP 9 (formerly Clustered Data ONTAP)	ONTAP versions 9.16.x antérieures à 9.16.1P8
NetApp	ONTAP 9 (formerly Clustered Data ONTAP)	ONTAP versions 9.17.x antérieures à 9.17.1P1
NetApp	ONTAP 9 (formerly Clustered Data ONTAP)	ONTAP versions 9.18.x antérieures à 9.18.1
NetApp	ONTAP 9 (formerly Clustered Data ONTAP)	ONTAP versions 9.14.x antérieures à 9.14.1P16
NetApp	ONTAP 9 (formerly Clustered Data ONTAP)	ONTAP versions 9.13.x antérieures à 9.13.1P19
NetApp	ONTAP 9 (formerly Clustered Data ONTAP)	ONTAP versions antérieures à 9.12.1P20
NetApp	ONTAP 9 (formerly Clustered Data ONTAP)	ONTAP versions 9.15.x antérieures à 9.15.1P16

References

Title

Publication Time

Tags

Bulletin de sécurité NetApp NTAP-20260304-0001

2026-03-04

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ONTAP versions 9.16.x ant\u00e9rieures \u00e0 9.16.1P8",
      "product": {
        "name": "ONTAP 9 (formerly Clustered Data ONTAP)",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "ONTAP versions 9.17.x ant\u00e9rieures \u00e0 9.17.1P1",
      "product": {
        "name": "ONTAP 9 (formerly Clustered Data ONTAP)",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "ONTAP versions 9.18.x ant\u00e9rieures \u00e0 9.18.1",
      "product": {
        "name": "ONTAP 9 (formerly Clustered Data ONTAP)",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "ONTAP versions 9.14.x ant\u00e9rieures \u00e0 9.14.1P16",
      "product": {
        "name": "ONTAP 9 (formerly Clustered Data ONTAP)",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "ONTAP versions 9.13.x ant\u00e9rieures \u00e0 9.13.1P19",
      "product": {
        "name": "ONTAP 9 (formerly Clustered Data ONTAP)",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "ONTAP versions ant\u00e9rieures \u00e0 9.12.1P20",
      "product": {
        "name": "ONTAP 9 (formerly Clustered Data ONTAP)",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "ONTAP versions 9.15.x ant\u00e9rieures \u00e0 9.15.1P16",
      "product": {
        "name": "ONTAP 9 (formerly Clustered Data ONTAP)",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-22052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22052"
    }
  ],
  "initial_release_date": "2026-03-05T00:00:00",
  "last_revision_date": "2026-03-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0238",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-03-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp ONTAP 9. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Vuln\u00e9rabilit\u00e9 dans NetApp ONTAP 9",
  "vendor_advisories": [
    {
      "published_at": "2026-03-04",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20260304-0001",
      "url": "https://security.netapp.com/advisory/NTAP-20260304-0001"
    }
  ]
}

CVE-2026-22052 (GCVE-0-2026-22052)

Vulnerability from cvelistv5 – Published: 2026-03-04 23:22 – Updated: 2026-03-04 23:22

Summary

ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.

Severity ?

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

Assigner

netapp

References

URL

Tags

https://security.netapp.com/advisory/NTAP-20260304-0001

Impacted products

	Vendor	Product	Version
	NETAPP	ONTAP 9	Affected: 9.12.1 and higher

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ONTAP 9",
          "vendor": "NETAPP",
          "versions": [
            {
              "status": "affected",
              "version": "9.12.1 and higher"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission."
            }
          ],
          "value": "ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "209",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-04T23:22:22.957Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/NTAP-20260304-0001"
        }
      ],
      "source": {
        "advisory": "NTAP-20260304-0001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2026-22052",
    "datePublished": "2026-03-04T23:22:22.957Z",
    "dateReserved": "2026-01-05T22:47:18.701Z",
    "dateUpdated": "2026-03-04T23:22:22.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2026-AVI-0238

Solutions

CVE-2026-22052 (GCVE-0-2026-22052)

Tags

Sightings

Nomenclature