CVE-2026-22049: Netapp Ontap

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.

Affected products

• Netapp Ontap: from 9.16.1, before 9.19.1 (fixed in 9.19.1)

Published 2026-07-22. Last modified 2026-08-20.