Medium 6.0Published Oct 27, 2026

CVE-2026-22063CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products

Updated under an hour ago (Oct 28, 2026, 10:30 PM ET)

Does this affect you?

It affects NetApp ONTAP 9 and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for NetApp ONTAP 9

Exploited in the last 30 days

The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.

CVSS: 6.0 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: netapp
NVD analysis: Deferred
Record last updated: Oct 27, 2026
First seen by InfoSec Signals: Oct 27, 2026

Affected products

Affected products

NetApp ONTAP 9 netapp:ontap_9 (from the name)	before 9.18.1	CNA record
NetApp StorageGRID (formerly StorageGRID Webscale) netapp:storagegrid_formerly_storagegrid_webscale (from the name)	through 12.2.0	CNA record
NetApp E-Series SANtricity OS Controller Software netapp:e_series_santricity_os_controller_software (from the name)	0	CNA record

References

References

https://security.netapp.com/advisory/NTAP-20261027-0001/

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.