Medium [CVE-2026-22063] eMudhra CA Certificate Compromise in NetApp Products
This medium-severity NetApp advisory covers CVE-2026-22063 affecting E-Series SANtricity OS Controller Software, NetApp HCI Baseboard Management Controller (BMC) - H610S, ONTAP 9.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Get an email when NetApp publishes the next one.
VulniPulse checks NetApp's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
Successful attackers could perform a Man-in-the-Middle attack.
ONTAP 9:
The “AAA Certificate Services” root certificate was preinstalled in versions prior to 9.18.1. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status.
Affected products named by the advisory: E-Series SANtricity OS Controller Software; NetApp HCI Baseboard Management Controller (BMC) - H610S; StorageGRID (formerly StorageGRID Webscale).
- 9.18.1
Official advisory · high-confidence parse· fetched 10 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists. Confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 10 hours ago·verify at source
Mitigation checklist
- NetApp HCI Baseboard Management Controller (BMC) - H610S has no planned fix; migrate to a supported release or product and consult NetApp's end-of-support notice.
- ONTAP 9:<br> Uninstall the “AAA Certificate Services” certificate using the "security certificate delete" command at the advanced privilege level. This command can also be used to uninstall any impacted certificates end users may have explicitly installed. <br><br> StorageGRID (formerly StorageGRID Webscale):<br> <a href="https://kb.netapp.com/hybrid/SGRID/Grid_Tenant_Manager_Issues/CSG-28116">https://kb.netapp.com/hybrid/SGRID/Grid_Tenant_Manager_Issues/CSG-28116</a>
Official advisory · high-confidence parse· fetched 10 hours ago·verify at source
More NetApp advisories
- CVE-2026-35189Oct 6, 2026OpenSSL Vulnerability in NetApp Products
- CVE-2026-32778Oct 21, 2026Libexpat Vulnerability in NetApp Products
- CVE-2026-31790Apr 17, 2026OpenSSL Vulnerability in NetApp Products
- CVE-2026-4437Apr 10, 2026March 2026 GNU C Library (glibc) Vulnerabilities in NetApp Products
- CVE-2024-47685Jun 13, 2025Linux Kernel Vulnerability in NetApp Products
- CVE-2026-56392Oct 23, 2026GNU Coreutils Vulnerability in NetApp Products
Android app · Google Play
Monitor future NetApp CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.