« Volver al listado

CVE-2026-22050

Estado: AnalizadaMedia (6.9)—

ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Netapp — Ontap

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-22050",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22050",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-12T17:36:52.693542Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-alert@netapp.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@netapp.com",
      "affectedData": [
        {
          "vendor": "NETAPP",
          "product": "ONTAP 9",
          "versions": [
            {
              "status": "affected",
              "version": "9.16.1",
              "lessThan": "9.16.1P9",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.17.1",
              "lessThan": "9.17.1P2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-12T18:15:48.983",
  "references": [
    {
      "url": "https://security.netapp.com/advisory/NTAP-20260112-0001",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@netapp.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none."
    },
    {
      "lang": "es",
      "value": "Las versiones de ONTAP 9.16.1 anteriores a 9.16.1P9 y 9.17.1 anteriores a 9.17.1P2 con el bloqueo de instantáneas habilitado son susceptibles a una vulnerabilidad que podría permitir a un atacante remoto privilegiado establecer el tiempo de caducidad de la instantánea en ninguno."
    }
  ],
  "lastModified": "2026-06-17T10:19:25.687",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.16.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F4EEB2C-B5F1-4FC0-BDCA-FC5D479A3D2D"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.16.1:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8503543F-FF0B-40DE-8073-5981BB4C417F"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.16.1:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03D060CA-5C40-4300-897A-D61F0CE3903E"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.16.1:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6487FE18-83D0-4FB4-B03B-1F40E3C683DB"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.16.1:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "642705FE-F97A-4371-B10D-682750C5C918"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.16.1:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EACF23BF-CDD4-45C4-A60D-F2A020E243DF"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.16.1:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4ECC94D1-F228-45FD-9AE3-EA29AA76CC9B"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.16.1:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05D4E5E5-9F21-42B5-9793-9107F7F0A769"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.16.1:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B40BBA5-F1A6-459F-8445-855F522B26A2"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.17.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84FA12AE-00D5-4BAC-90D1-0B2003487DE9"
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap:9.17.1:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B98EBF4C-1A89-488C-B6C7-7306DA6867E4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@netapp.com"
}