Netapp vulnerabilities39 known to be exploited.
Netapp has 2,458 published vulnerabilities across 395 products in our catalogue. 39 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Oncommand Insight, with 959. If you run Netapp software, patch the exploited flaws first.
The most recent Netapp flaw added to the known-exploited list is CVE-2022-0995, on 26 August 2026. We keep watching the known-exploited list.
Which Netapp products have the most vulnerabilities?
Oncommand Insight leads with 959 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Netapp vulnerabilities are being exploited?
39 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.8Linux Kernel Out-of-Bounds Write Vulnerability
Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.
- 7.8Linux Kernel Improper Authentication Vulnerability
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
- 7.8Linux Kernel Integer Overflow Vulnerability
Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their...
- 7.8Linux Kernel Heap Out-of-Bounds Write Vulnerability
Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
- 9.8AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface.
- 9.1Apache HTTP Server Improper Escaping of Output Vulnerability
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not...
- 9.8Apache Tomcat Path Equivalence Vulnerability
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.
- 7.07-Zip Mark of the Web Bypass Vulnerability
7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.
Which Netapp flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers...
- >99%
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used...
- >99%
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.
- >99%CVE-2020-13379High
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue.
- >99%
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.
- >99%
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote...
- >99%
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.
- >99%CVE-2020-11022Medium
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
- 98%CVE-2019-5736High
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command...
All Netapp products we track.
62 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Oncommand Insightoncommand_insight959 vulnerabilities30 versions
- Active Iq Unified Manageractive_iq_unified_manager827 vulnerabilities5 versions
- Oncommand Workflow Automationoncommand_workflow_automation734 vulnerabilities10 versions
- Snapcentersnapcenter566 vulnerabilities24 versions
- E-Series Santricity OS Controllere-series_santricity_os_controller242 vulnerabilities20 versions
- Clustered Data Ontapclustered_data_ontap190 vulnerabilities41 versions
- Snapmanagersnapmanager180 vulnerabilities11 versions
- Ontap Select Deploy Administration Utilityontap_select_deploy_administration_utility172 vulnerabilities11 versions
- Oncommand Unified Manageroncommand_unified_manager169 vulnerabilities14 versions
- Solidfire & Hci Management Nodesolidfire_\&_hci_management_node96 vulnerabilities1 version
- Oncommand Balanceoncommand_balance83 vulnerabilities1 version
- 7-Mode Transition Tool7-mode_transition_tool75 vulnerabilities14 versions
- Storagegridstoragegrid72 vulnerabilities74 versions
- Virtual Storage Consolevirtual_storage_console70 vulnerabilities6 versions
- Vasa Provider for Clustered Data Ontapvasa_provider_for_clustered_data_ontap69 vulnerabilities5 versions
- Oncommand Shiftoncommand_shift63 vulnerabilities1 version
- Storage Replication Adapter for Clustered Data Ontapstorage_replication_adapter_for_clustered_data_ontap63 vulnerabilities3 versions
- Data Ontapdata_ontap42 vulnerabilities24 versions
- Snap Creator Frameworksnap_creator_framework42 vulnerabilities8 versions
- Hci Baseboard Management Controllerhci_baseboard_management_controller33 vulnerabilities11 versions
- Service Level Managerservice_level_manager29 vulnerabilities4 versions
- Oncommand System Manageroncommand_system_manager27 vulnerabilities15 versions
- Snapcenter Serversnapcenter_server23 vulnerabilities9 versions
- Ontap Toolsontap_tools22 vulnerabilities2 versions
This directory lists the 62 Netapp products with at least one tracked version, of 395 in our catalogue.
Running Netapp? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.
- Matched to
- Netapp on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 2,458 published vulnerabilities across 395 products and 584 versions from Netapp. The most recent Netapp flaw added to the known-exploited list is CVE-2022-0995, on 26 August 2026.
39 Netapp vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2022-0995, CVE-2022-0492 and CVE-2018-14634. The full list is on this page.
Oncommand Insight, with 959 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the Netapp products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.