Ontap
29 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Ontap, a product in the hardware firmware space. Use it to gauge the current risk picture and drill into individual advisories.
Ontap CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 1 |
| 2024-12 | 1 |
| 2025-01 | 0 |
| 2025-02 | 4 |
| 2025-03 | 3 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 1 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 29 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High13
- Medium9
- Low4
Latest CVEs
The 15 most recently published vulnerabilities affecting Ontap.
- CVE-2026-22049ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited coul...8.8
- CVE-2026-22050ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snaps...4.3
- CVE-2025-1861Stream HTTP wrapper truncates redirect location to 1024 bytes9.8
- CVE-2025-1736Stream HTTP wrapper header check might omit basic auth header7.3
- CVE-2025-1734Streams HTTP wrapper does not fail for headers with invalid name and no colon5.3
- CVE-2025-26465Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled6.8
- CVE-2025-24928libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untruste...7.8
- CVE-2024-56171libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be ...7.8
- CVE-2025-0167netrc and default credential leak3.4
- CVE-2024-11053netrc and redirect credential leak3.4
- CVE-2024-8932OOB access in ldap_escape9.8
- CVE-2024-39573Apache HTTP Server: mod_rewrite proxy handler substitution7.5
- CVE-2024-38473Apache HTTP Server proxy encoding problem8.1
- CVE-2024-38472Apache HTTP Server on WIndows UNC SSRF7.5
- CVE-2024-36387Apache HTTP Server: DoS by Null pointer in websocket over HTTP/25.4
Product grouping is registry-driven, with AI assist and human review. How it works