Netapp Ontap vulnerabilities

25 CVEs affecting Netapp Ontap, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-22049, published 2026-07-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-6387, published 2024-07-01. High severity, CVSS 8.1. EPSS: 99.5% chance of exploitation in the next 30 days. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote…
CVE-2024-27316, published 2024-04-04. High severity, CVSS 7.5. EPSS: 91.3% chance of exploitation in the next 30 days. HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory…
CVE-2024-38472, published 2024-07-01. High severity, CVSS 7.5. EPSS: 69.5% chance of exploitation in the next 30 days. SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which…
CVE-2024-39573, published 2024-07-01. High severity, CVSS 7.5. EPSS: 37.2% chance of exploitation in the next 30 days. Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to…
CVE-2024-38473, published 2024-07-01. High severity, CVSS 8.1. EPSS: 25.9% chance of exploitation in the next 30 days. Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted…
CVE-2025-26465, published 2025-02-18. Medium severity, CVSS 6.8. EPSS: 7.7% chance of exploitation in the next 30 days. A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue…
CVE-2023-38709, published 2024-04-04. High severity, CVSS 7.3. EPSS: 3.9% chance of exploitation in the next 30 days. Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.
CVE-2024-24795, published 2024-04-04. Medium severity, CVSS 6.3. EPSS: 2.9% chance of exploitation in the next 30 days. HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization…
CVE-2024-28757, published 2024-03-10. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVE-2024-11053, published 2024-12-11. Low severity, CVSS 3.4. EPSS: 2% chance of exploitation in the next 30 days. When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…

Latest

CVE-2026-22049, published 2026-07-22. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could…
CVE-2026-22052, published 2026-03-05. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the…
CVE-2026-22050, published 2026-01-12. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the…
CVE-2025-1861, published 2025-03-30. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit…
CVE-2025-1736, published 2025-03-30. High severity, CVSS 7.3. EPSS: 0.5% chance of exploitation in the next 30 days. In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line…
CVE-2025-1734, published 2025-03-30. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as…
CVE-2025-24928, published 2025-02-18. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted…
CVE-2024-56171, published 2025-02-18. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be…
CVE-2025-0167, published 2025-02-05. Low severity, CVSS 3.4. EPSS: 0.7% chance of exploitation in the next 30 days. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…