CVE-2026-28386: OpenSSL Vulnerability in NetApp Products
Not in the CISA KEV catalog. Medium advisory severity (CVSS 5.9, Red Hat).
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-28386 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Medium
- CVSS base score
- 5.9 (Red Hat), 4.7 (NetApp)
- Weakness
- CWE-805
- Fixed releases
- Red Hat: RHSA-2026:7261
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-28386; bulletin-wide values are not repeated here.
Is CVE-2026-28386 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-28386 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-28386?
Upgrade to a fixed release named by the vendor:
- Red Hat: RHSA-2026:7261
- NetApp HCI Baseboard Management Controller (BMC) - H610S has no planned fix; migrate to a supported release or product and consult NetApp's end-of-support notice. (NetApp)
- Update the affected package(s) to the fixed version shipped in RHSA-2026:7261 (`sudo dnf update` / `yum update`). (Red Hat)
Get an email when NetApp publishes the next one.
See NetApp's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Vendor advisory comparison
NetApp
1 advisory- Advisory severityMedium4.7
Medium [CVE-2026-28386] OpenSSL Vulnerability in NetApp Products
NTAP-20260417-0016Source published Source updated
Multiple NetApp products incorporate OpenSSL. Certain versions of OpenSSL are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: NetApp HCI Baseboard Management Controller (BMC) - H610S. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
- Affected products in this advisory
- NetApp HCI Baseboard Management Controller (BMC) - H610S
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- NetApp HCI Baseboard Management Controller (BMC) - H610S has no planned fix; migrate to a supported release or product and consult NetApp's end-of-support notice.
Red Hat
1 advisory- Advisory severityMedium5.9
Medium [CVE-2026-28386] Denial of Service due to out-of-bounds read in AES-CFB128
CVE-2026-28386Source published
Denial of Service due to out-of-bounds read in AES-CFB128. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-805. Affected package(s): openssl-main. Resolved in Red Hat advisory RHSA-2026:7261 — update the affected packages (`sudo dnf update`).
- Related products — impact not confirmed
- openssl-main
- Red Hat Enterprise Linux
- Source-reported affected versions
- openssl-main-3.5.6-0.1.hum1
- Source-reported fixed versions
- RHSA-2026:7261
- Mitigation guidance
- Update the affected package(s) to the fixed version shipped in RHSA-2026:7261 (`sudo dnf update` / `yum update`).
More NetApp advisories
- CVE-2026-53176Oct 30, 2026Linux Kernel Vulnerability in NetApp Products
- CVE-2026-64106Oct 30, 2026Linux Kernel Vulnerability in NetApp Products
- CVE-2026-53088Oct 30, 2026Linux Kernel Vulnerability in NetApp Products
- CVE-2026-46137Oct 30, 2026Linux Kernel Vulnerability in NetApp Products
- CVE-2026-52999Oct 30, 2026Linux Kernel Vulnerability in NetApp Products
- CVE-2025-21796Oct 30, 2026Linux Kernel Vulnerability in NetApp Products
Follow CVE-2026-28386 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
iPhone and Android apps · New on the App Store
Get alerts for new CVEs on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
