NetApp StorageGRID versions prior to 11.9.0.12 and 12.0.0.4 that have Single Sign‑On enabled and use Microsoft Entra ID as an identity provider are vulnerable to a Server‑Side Request Forgery flaw. An attacker who is authenticated but has only low privileges can exploit the vulnerability to delete configuration data or make certain resources unavailable. The weakness is identified as CWE‑918.

The affected product is NetApp StorageGRID (formerly StorageGRID Webscale). Vulnerable releases are any version earlier than 11.9.0.12 and 12.0.0.4 when Single Sign‑On is enabled and Microsoft Entra ID is configured as the identity provider.

The CVSS score of 7.1 indicates a high severity, with a low EPSS probability (<1%) and no listing in the CISA KEV catalog, suggesting a low exploitation likelihood at the present time. The attack vector is inferred to require authenticated access; a user with limited permissions can trigger the SSRF to target internal resources via the StorageGRID server, potentially deleting configuration data or blocking access to resources. Public exploitation is not documented, but the vulnerability can be leveraged by insiders or compromised low‑privilege accounts to disrupt the system’s operation.