CVE-2026-22052

5.3 mediumEPSS 0.2%

Medium (5.3) in netapp ontap. EPSS 0.2% chance of exploitation in the next 30 days.

ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-209
Published: 2026-03-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

netapp:ontap

References

https://security.netapp.com/advisory/NTAP-20260304-0001

Check your stack JSON