What’s Vulnerable › Products

NetApp ONTAP 9 vulnerabilities

26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your NetApp ONTAP 9 version is affected

Latest NetApp ONTAP 9 vulnerabilities

• CVE-2026-22063 — CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products (CVSS 6.0)
• CVE-2026-22049 — (CVSS 8.8)
• CVE-2026-22052 — (CVSS 4.3)
• CVE-2026-22050 — (CVSS 4.3)
• CVE-2025-1861 — Stream HTTP wrapper truncates redirect location to 1024 bytes (CVSS 9.8)
• CVE-2025-1736 — Stream HTTP wrapper header check might omit basic auth header (CVSS 7.3)
• CVE-2025-1734 — Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVSS 5.3)
• CVE-2025-24928 — (CVSS 7.7)
• CVE-2024-56171 — (CVSS 9.8)
• CVE-2025-26465 — Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled (CVSS 6.8)
• CVE-2025-0167 — netrc and default credential leak (CVSS 3.4)
• CVE-2024-11053 — netrc and redirect credential leak (CVSS 3.4)
• CVE-2024-8932 — OOB access in ldap_escape (CVSS 9.8)
• CVE-2024-39573 — Apache HTTP Server: mod_rewrite proxy handler substitution (CVSS 7.5)
• CVE-2024-38473 — Apache HTTP Server proxy encoding problem (CVSS 8.1)
• CVE-2024-38472 — Apache HTTP Server on WIndows UNC SSRF (CVSS 7.5)
• CVE-2024-36387 — Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVSS 5.4)
• CVE-2024-6387 — Openssh: regresshion - race condition in ssh allows rce/dos (CVSS 8.1)
• CVE-2024-27316 — Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVSS 7.5)
• CVE-2024-24795 — Apache HTTP Server: HTTP Response Splitting in multiple modules (CVSS 6.3)
• CVE-2023-38709 — Apache HTTP Server: HTTP response splitting (CVSS 7.3)
• CVE-2024-2004 — Usage of disabled protocol (CVSS 3.5)
• CVE-2024-28757 — (CVSS 7.5)
• CVE-2023-4408 — Parsing large DNS messages may cause excessive CPU load (CVSS 7.5)
• CVE-2023-27317 — Information Disclosure Vulnerability in ONTAP 9 (CVSS 4.6)