Description
ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.
Published: 2026-03-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure – Directory Listing Exposure
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows a user with valid credentials to retrieve a listing of objects in an S3 NAS bucket directory that the user is not authorized to view, exposing sensitive information. The flaw is classified as CWE-209, Information Exposure Through Used Output. The impact is a disclosure of potentially confidential data from the ONTAP filesystem.

Affected Systems

NETAPP ONTAP 9, versions 9.12.1 and newer that include S3 NAS bucket support.

Risk and Exploitability

CVSS score 5.3 indicates moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at this time, and the vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires authenticated access to the ONTAP S3 NAS bucket environment; attackers would need to possess user credentials that allow S3 operations, then issue a request to list a protected directory.

Generated by OpenCVE AI on April 17, 2026 at 13:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ONTAP to a version where the Information Disclosure flaw is fixed.
  • Apply the least‑privilege principle by restricting S3 NAS bucket permissions to only the necessary users and roles.
  • Enable logging and periodically review audit trails for unnecessary directory listing requests.

Generated by OpenCVE AI on April 17, 2026 at 13:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Apr 2026 13:30:00 +0000

Type Values Removed Values Added
Title Authenticated Directory Listing Disclosure in ONTAP S3 NAS Buckets

Fri, 13 Mar 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Netapp ontap
CPEs cpe:2.3:a:netapp:ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
Vendors & Products Netapp ontap
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Fri, 06 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-209
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 05 Mar 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Netapp
Netapp ontap 9
Vendors & Products Netapp
Netapp ontap 9

Wed, 04 Mar 2026 23:30:00 +0000

Type Values Removed Values Added
Description ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission.
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Netapp Ontap Ontap 9
cve-icon MITRE

Status: PUBLISHED

Assigner: netapp

Published:

Updated: 2026-03-06T18:25:24.078Z

Reserved: 2026-01-05T22:47:18.701Z

Link: CVE-2026-22052

cve-icon Vulnrichment

Updated: 2026-03-06T18:25:18.771Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-05T00:15:56.550

Modified: 2026-03-13T01:37:59.053

Link: CVE-2026-22052

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T13:15:19Z

Weaknesses