Netapp Storagegrid vulnerabilities

74 CVEs affecting Netapp Storagegrid, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-22056, published 2026-08-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2017-15715, published 2018-03-26. High severity, CVSS 8.1. EPSS: 85.5% chance of exploitation in the next 30 days. In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could…
CVE-2022-0778, published 2022-03-15. High severity, CVSS 7.5. EPSS: 73.2% chance of exploitation in the next 30 days. The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates…
CVE-2018-1303, published 2018-03-26. High severity, CVSS 7.5. EPSS: 69.8% chance of exploitation in the next 30 days. A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be…
CVE-2025-25292, published 2025-03-12. Critical severity, CVSS 9.8. EPSS: 65.1% chance of exploitation in the next 30 days. ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a…
CVE-2021-34798, published 2021-09-16. High severity, CVSS 7.5. EPSS: 64.5% chance of exploitation in the next 30 days. Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2021-36160, published 2021-09-16. High severity, CVSS 7.5. EPSS: 62.9% chance of exploitation in the next 30 days. A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).
CVE-2017-7668, published 2017-06-20. High severity, CVSS 7.5. EPSS: 57.5% chance of exploitation in the next 30 days. The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously…

Latest

CVE-2026-22056, published 2026-08-28. Low severity, CVSS 2.3. EPSS: 0.2% chance of exploitation in the next 30 days. StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow…
CVE-2026-22051, published 2026-04-20. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated…
CVE-2025-26517, published 2025-09-19. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful exploit could allow an unauthorized…
CVE-2025-26516, published 2025-09-19. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated…
CVE-2025-26515, published 2025-09-19. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without Single Sign-on enabled are susceptible to a Server-Side Request Forgery (SSRF) vulnerability.…
CVE-2025-26514, published 2025-09-19. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Reflected Cross-Site Scripting vulnerability. Successful exploit could allow an attacker…
CVE-2025-25291, published 2025-03-12. Critical severity, CVSS 9.8. EPSS: 21% chance of exploitation in the next 30 days. ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a…
CVE-2024-21994, published 2024-11-08. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authenticated attacker could lead to a service…
CVE-2024-21988, published 2024-06-14. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM attacks due to a vulnerability in the SSH…