CVE-2026-40977: Spring Boot Vulnerability in NetApp Products
This NetApp advisory covers CVE-2026-40977 in Data Infrastructure Insights and Data Secure Storage Workload Security Agent.
Key facts
- Vendor rating
- Medium, CVSS 4.7
- CISA KEV
- Not listed (catalogue checked )
- Advisory id
- NTAP-20260605-0009
- Source published
- Source revised
- Listed by VulniPulse
- Record changed
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Multiple NetApp products incorporate Spring Boot. Certain versions of Spring Boot are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or Denial of Service (DoS).
Affected products: Data Infrastructure Insights and Data Secure Storage Workload Security Agent. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status.
NetApp states there is no workaround available at this time.
Text from the source record.
How to fix CVE-2026-40977
Vendor guidance
- Data Infrastructure Insights and Data Secure Storage Workload Security Agent: Fixed as of 20260803.
CVE-2026-40977 in other vendors' advisories
- VMware: CVE-2026-40977, medium severity
More NetApp advisories
CVE-2026-115557Nov 6, 2026CPython Vulnerability in NetApp ProductsCVE-2026-91332Oct 30, 2026October 2026 Java SE 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27CVE-2026-91373Oct 30, 2026October 2026 Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1CVE-2026-101516Oct 30, 2026October 2026 Java SE Vulnerabilities 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27CVE-2026-91403Oct 28, 2026Java SE Vulnerability in NetApp ProductsCVE-2026-91394Oct 28, 2026Java SE Vulnerability in NetApp Products
Get an email when NetApp OnCommand / Data Infrastructure Insights publishes the next one.
See NetApp OnCommand / Data Infrastructure Insights's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future NetApp CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
