The private keys of eight intermediate CA certificates issued by eMudhra were compromised and revoked on October 18, 2026. Although there is no software flaw, the CVE tracks changes that may affect NetApp products that rely on these certificates. Compromise of the keys undermines the trust chain, allowing a malicious actor to forge certificates that could be accepted by NetApp services, thereby exposing data to confidentiality, integrity, or authenticity risks.

Affected systems include NetApp's E-Series SANtricity OS Controller Software, ONTAP 9, and StorageGRID (formerly StorageGRID Webscale). The advisory does not list specific affected versions, so all current and future deployments that depend on eMudhra intermediate certificates for authentication or encryption should be considered at risk until mitigated.

The CVSS score of 6 indicates moderate severity. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. Potential exploitation would require an attacker with the compromised private keys to issue fraudulent certificates that pass validation in NetApp products. While no direct exploit path is documented, the loss of certification integrity elevates the risk of certificate misuse, warranting timely remediation.