The vulnerability allows a privileged remote attacker to configure snapshot expiration to none on NetApp ONTAP 9, meaning snapshots will never be automatically purged. This can lead to unbounded growth of stored data, potentially exhausting storage capacity and violating retention policies. The weakness is a lack of proper access control, represented by CWE‑639.

NetApp ONTAP 9.16.1 versions prior to P9 and 9.17.1 versions prior to P2, when snapshot locking is enabled.

The CVSS score of 6.9 indicates a medium risk level. The EPSS score of less than 1% shows a very low probability of exploitation at present. The vulnerability is not yet listed in the CISA KEV catalog. It requires a privileged user with network access to the ONTAP management interface; the attacker must be able to send configuration commands over the network. Because of the limited target scope, the potential impact is confined to environments using these specific ONTAP releases.