Highest advisory severityCritical 2 vendors · 2 advisories

CVE-2026-55200

Libssh2 Vulnerability in NetApp Products

CVE-2026-55200: Libssh2 Vulnerability in NetApp Products. Not in the CISA KEV catalog. Critical advisory severity (CVSS 9.2, NetApp).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when NetApp publishes the next one.

See NetApp's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about NetApp

CVE-2026-55200 key facts

CISA KEV: Not listed (catalog checked Nov 2, 2026)
Highest advisory severity: Critical
CVSS base score: 9.2 (NetApp), 7.1 (Red Hat)
Fixed releases: NetApp: Active IQ Unified Manager for VMware vSphere: 9.18P3
Red Hat: 1.11.1, libssh2-main-1.11.1-8.hum1, RHSA-2026:29950
Vendor advisories: 2 from NetApp, Red Hat
VulniPulse record: Published Jul 6, 2026 · Updated Oct 24, 2026

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-55200; bulletin-wide values are not repeated here.

Is CVE-2026-55200 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-55200 is not in the CISA KEV catalog (checked Nov 2, 2026) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-55200?

Upgrade to a fixed release named by the vendor:

NetApp: Active IQ Unified Manager for VMware vSphere: 9.18P3
Red Hat: 1.11.1, libssh2-main-1.11.1-8.hum1, RHSA-2026:29950

Update affected NetApp products to a fixed release: Active IQ Unified Manager for VMware vSphere: 9.18P3. (NetApp)
The primary mitigation is strict network access control. Ensure libssh2 clients only connect to trusted SSH servers, and use firewalls to block untrusted incoming connections if libssh2 is deployed as a server-side application. (Red Hat)

Vendor advisory comparison

NetApp

1 advisory

Advisory severityCritical9.2
Critical [CVE-2026-55200] Libssh2 Vulnerability in NetApp Products
NTAP-20260703-0020Source published Jul 3, 2026Source updated Oct 24, 2026
Libssh2 versions through 1.11.1 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). Cloud Volumes ONTAP Mediator: Affected versions 9.17.1P4 through 9.17.1P9, 9.18.1P1 through 9.18.1P5 and 9.19.1GA through 9.19.1P1. Affected products: Active IQ Unified Manager for VMware vSphere, Cloud Volumes ONTAP Mediator, ONTAP Select Deploy administration utility. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status.
Affected products in this advisory
Active IQ Unified Manager for VMware vSphere
Cloud Volumes ONTAP Mediator
ONTAP Select Deploy administration utility
Source-reported affected versions
1.11.1
9.17
9.18
9.19
Source-reported fixed versions
Active IQ Unified Manager for VMware vSphere: 9.18P3
Mitigation guidance
Update affected NetApp products to a fixed release: Active IQ Unified Manager for VMware vSphere: 9.18P3.
Workarounds
Cloud Volumes ONTAP Mediator:<br> Ensure SSH remains blocked (default) in unfixed versions.
Full advisory and evidence Open source bulletin

Red Hat

1 advisory

Advisory severityHigh7.1
High [CVE-2026-55200] libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
CVE-2026-55200Source published Jun 17, 2026Source updated Jun 17, 2026
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. An out-of-bounds write vulnerability exists in the libssh2 client. A remote attacker can exploit this by sending a specially crafted SSH packet with an abnormally large length value. This corrupts the application's memory and can potentially allow the attacker to execute arbitrary code on the affected system. An Important out-of-bounds write vulnerability was discovered in libssh2. As it only impacts client installations of the library, exploitation would require a…
Affected products in this advisory
Red Hat Hardened Images
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 8
Red Hat package: libssh2
Source-reported affected versions
Affected-version details not available in this record.
Source-reported fixed versions
1.11.1
libssh2-main-1.11.1-8.hum1
RHSA-2026:29950
Mitigation guidance
The primary mitigation is strict network access control. Ensure libssh2 clients only connect to trusted SSH servers, and use firewalls to block untrusted incoming connections if libssh2 is deployed as a server-side application.
Full advisory and evidence Open source bulletin

All NetApp advisories

Follow CVE-2026-55200 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Get alerts for new CVEs on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features