Information Disclosure Vulnerability in ONTAP by NetApp
CVE-2026-22052

5.3MEDIUM

Key Information:

Vendor

Netapp

Status
Ontap 9
Vendor
CVE Published:
4 March 2026

What is CVE-2026-22052?

The ONTAP product line from NetApp, specifically versions 9.12.1 and above, is vulnerable to an information disclosure issue affecting S3 NAS buckets. This vulnerability allows an authenticated user to gain unauthorized access to directory listings, exposing sensitive content that they should not have permission to view. Such a flaw can lead to significant security risks, compromising data integrity and user privacy.

Affected Version(s)

ONTAP 9 9.12.1 and higher

References

https://security.netapp.com/advisory/NTAP-20260304-0001

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.