CVE-2026-22048: Netapp Storagegrid Formerly Storagegrid Webscale

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources.

Affected products

• Netapp Storagegrid Formerly Storagegrid Webscale: before 11.9.0.12 (fixed in 11.9.0.12); from 12.0.0.0, before 12.0.0.4 (fixed in 12.0.0.4)

Published 2026-02-18. Last modified 2026-06-17.