CVE-2026-22050

Published: Jan 12, 2026Modified: Jun 17, 2026

6.9

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-alert@netapp.com (Secondary)

Description

ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none.

Affected (11)

Products: Netapp: Ontap

Netapp

1 product

Ontap

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Netapp Ontap	Version 9.16.1
Netapp Ontap	Version 9.16.1 p1
Netapp Ontap	Version 9.16.1 p2
Netapp Ontap	Version 9.16.1 p3
Netapp Ontap	Version 9.16.1 p4
Netapp Ontap	Version 9.16.1 p5
Netapp Ontap	Version 9.16.1 p6
Netapp Ontap	Version 9.16.1 p7
Netapp Ontap	Version 9.16.1 p8
Netapp Ontap	Version 9.17.1
Netapp Ontap	Version 9.17.1 p1

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (1)

https://security.netapp.com/advisory/NTAP-20260112-0001

Source: security-alert@netapp.com

Vendor Advisory

Timeline

No history available yet.