CVE-2024-21988: CVE-2024-21988 SSH Cryptographic Implementation Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-14 · updated 2026-06-17
Weakness: CWE-347

Description

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM attacks due to a vulnerability in the SSH cryptographic implementation.

Affected products

NetApp StorageGRID: before 11.7.0.9; from 11.8.0 before 11.8.0.5 — fixed in 11.7.0.9, 11.8.0.5

How to fix

Upgrade to a fixed version: NetApp StorageGRID 11.7.0.9, 11.8.0.5. Check the vendor advisory for mitigations.

References

https://security.netapp.com/advisory/ntap-20240614-0010/
https://security.netapp.com/advisory/ntap-20240614-0010/

Get alerted when CVE-2024-21988 or the next vulnerability affects your stack