CVE-2026-21933

High [CVE-2026-21925 +3] January 2026 Java Platform Standard Edition Vulnerabilities in NetApp Products

NTAP-20260123-0012Source published Jan 23, 2026Source updated Oct 6, 2026

This bulletin covers 4 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Multiple NetApp products incorporate the Oracle Java Platform, Standard Edition (Java SE). Java SE versions 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, and 25.0.1 are susceptible to vulnerabilities that could allow an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Refer to “Oracle Critical Patch Update Advisory - January 2026” for additional details. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data, unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data, and unauthorized ability to cause a hang or…

Affected products in this advisory

• Active IQ Unified Manager for VMware vSphere
• Data Infrastructure Insights and Data Secure Storage Workload Security Agent
• NetApp Console Agent
• OnCommand Insight

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• Refer to “Oracle Critical Patch Update Advisory - January 2026” for additional details.
• Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data, unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data, and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE.

Workarounds

• <p> If a product requires JRE but does not include it, please update JRE to a fixed version that aligns with the product requirements. <br><br> <a href="https://kb.netapp.com/Advice_and_Troubleshooting/Data_Infrastructure_Management/E-Series_SANtricity_Management_Software/How_to_update_the_Java_Runtime_Environment_(JRE)__Storage_Manager_11.10_or_later" target="_blank">Updating the Java Runtime Environment (JRE) used by SANtricity Storage Manager 11.10 or later </a> <br><br> In Full Support versions of OnCommand Workflow Automation and Active IQ Unified Manager for Linux & Windows the Java software can be upgraded as specified in the product documentation. For assistance with upgrade issues please consult technical support. <br><br> In Full Support versions of OnCommand Insight the Java software can be upgraded. For assistance with the upgrade and access to the updated OnCommand Insight binaries please consult technical support. <br><br> </p>

Medium [CVE-2026-21933] Improve HttpServer Request handling (Oracle CPU 2026-01)

CVE-2026-21933Source published Jan 20, 2026

Improve HttpServer Request handling (Oracle CPU 2026-01). Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-93. Affected package(s): java. Resolved in Red Hat advisory RHSA-2026:0895 — update the affected packages (`sudo dnf update`).

Related products — impact not confirmed

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 1
• Red Hat Enterprise Linux 9

1 more entries in the full advisory.

Source-reported affected versions

• java-1.8.0-ibm-1:1.8.0.8.60-1.el8_10
• java-11-openjdk-1:11.0.30.0.7-1.el7_9
• java-25-openjdk-1:25.0.2.0.10-1.el10
• java-1.8.0-openjdk-1:1.8.0.482.b08-1.el7_9

8 more entries in the full advisory.

Source-reported fixed versions

• RHSA-2026:0895

Mitigation guidance

• Update the affected package(s) to the fixed version shipped in RHSA-2026:0895 (`sudo dnf update` / `yum update`).