{"resourceId":"netapp-advisory-ntap-20261102-0001-linux-kernel-tcp-rce-interim-20261102","versions":[{"version":"external-e5c52d73187dee1057907c2f8f3af18ab222a98b797919334f0a9b6315c83aad","resource":{"id":"netapp-advisory-ntap-20261102-0001-linux-kernel-tcp-rce-interim-20261102","title":"NetApp interim advisory NTAP-20261102-0001: critical Linux kernel TCP flaw (CVE-2026-98432, CVSS 9.8) allows unauthenticated remote root; product impact not yet listed","organization":"NetApp Product Security","sector":"Storage vendor security advisory","geography":"Global","publishedAt":"Advisory v2.0, last updated 2 November 2026","publicationDate":"2026-11-02","eventDate":null,"sourceName":"NetApp Product Security","sourceLabel":"NetApp, Security Advisory NTAP-20261102-0001 (v2.0, Interim), 2 Nov 2026","sourceUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"NetApp published interim advisory NTAP-20261102-0001 (version 2.0, updated 2 November) for CVE-2026-98432, a Linux kernel flaw affecting kernels from 4.4 across multiple stable branches that could let remote unauthenticated attackers run commands as root. NetApp rates it critical (CVSS 3.1 9.8) and warns of information disclosure, data modification or denial of service. It says it is aware of public discussion of the vulnerability. The rendered advisory lists no affected or fixed NetApp products yet and says NetApp will update it as information becomes available.","sledRelevance":"Relevant to agencies, universities and K-12 districts running NetApp systems or Linux-based NetApp appliances and management software, including AI data pipelines. An interim advisory with no product list means IT teams cannot yet rule NetApp components in or out; they need to watch for updates and harden network exposure meanwhile.","evidence":"Opened the advisory page; it shows summary, impact, CVSS details, exploitation status and a kernel.org reference, with no affected or remediated product details in the rendered page. This is vendor security guidance, not independent evidence; the vulnerability itself is in the upstream Linux kernel.","architectureImplications":"Linux-based components exposed on IPv4 TCP are in scope at the kernel level; which NetApp products embed affected kernels is not yet stated.","governanceImplications":"Patch governance should track interim advisories to final status and record exposure decisions.","securityPrivacyImplications":"Critical unauthenticated remote root execution; limit management-plane network exposure until NetApp lists affected products and fixes.","caveats":"Interim status; no product list or fixes shown at retrieval. Severity is the generic kernel score, not product-specific.","streamIds":["netapp"],"roles":{"sales":"Lead with patch readiness, not product. NetApp's 2 November interim advisory flags a critical (9.8) Linux kernel flaw allowing unauthenticated remote root, but lists no affected NetApp products yet. Public-sector storage and security owners will want to know their exposure. Offer a bounded exposure review of NetApp management interfaces and Linux-based components. Do not claim NetApp products are affected or safe; the advisory does not say yet.","engineering":"Frame fit as exposure triage. The flaw is in upstream Linux kernels from 4.4; NetApp has not yet said which products embed affected kernels. Prerequisites are an inventory of NetApp systems, versions and network exposure. Constrain management interfaces to admin networks and monitor the advisory for product and fix listings. Proof of value is confirming the inventory is complete and that management planes are unreachable from untrusted networks.","delivery":"Treat this as a tracked security action. Work covers inventory, network exposure review and patch scheduling once fixes are listed. Security operations owns monitoring, with storage administrators applying updates. Governance checkpoints include change approval for patches and documented risk acceptance while the advisory is interim. Acceptance criteria below are proposals. Risks include delayed fixes and maintenance windows for storage systems."},"roleDetails":{"sales":{"customerProblem":"Storage and security teams cannot tell whether their NetApp systems are exposed to a critical kernel flaw.","stakeholders":["CISO","Storage administrators","Security operations","Infrastructure manager"],"discoveryQuestions":["Can you list every NetApp system and version you run?","Are management interfaces reachable from user or internet networks?","How fast can you schedule storage maintenance?"],"valueHypothesis":"A quick exposure review could reduce risk while NetApp finalizes the advisory.","potentialEngagement":"A bounded exposure and patch-readiness review of NetApp estate.","unsupportedClaims":["NetApp products are affected","NetApp products are safe","Fix timelines"]},"engineering":{"fit":"Any SLED estate running NetApp systems or Linux-based NetApp software.","architectureIntegration":"Kernel-level flaw in IPv4 TCP handling; product mapping pending from NetApp.","prerequisites":["Asset inventory","Version data","Network exposure map"],"constraints":["Interim advisory","No product list or fixes yet"],"security":"Restrict management-plane access to admin networks and monitor for exploitation.","proofOfValue":["Inventory reconciles with support records","Management interfaces unreachable from untrusted networks","Advisory rechecked until final"]},"delivery":{"work":"Inventory, exposure review, monitoring and patch scheduling once fixes are published.","dependencies":["NetApp advisory updates","Maintenance windows","Change approval"],"ownership":"Security operations with storage administrators.","skillsAdoption":"Staff track NetApp advisory remediation tabs.","governanceCheckpoints":["Documented risk acceptance while interim","Change approval for patches"],"acceptanceCriteria":["All NetApp assets inventoried within an agreed window (proposal)","Fixes applied within policy deadline after release (proposal)"],"risks":["Delayed vendor fixes","Unplanned outages from patching","Incomplete inventory"]}},"retrievedAt":"2026-11-02T22:07:09-06:00","enrichedAt":"2026-11-02T22:20:00-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"None stated.","procurementImplications":"Support contracts should cover timely access to fixes for embedded kernels.","operatingModelImplications":"Security operations should add the advisory to watch lists and recheck it daily.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","referenceExcerpt":"susceptible to a vulnerability which could allow remote unauthenticated attackers to execute commands with root privileges.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}},{"version":"external-41c7b5087a0462c415c3fe105a6a1bd5fecdc5f69de3cfe6eeb9aa2c96c9e5fc","resource":{"id":"netapp-advisory-ntap-20261102-0001-linux-kernel-tcp-rce-interim-20261102","title":"NetApp advisory NTAP-20261102-0001 v7.0: first fixes published (E-Series SANtricity OS 11.90R7 and 12.10R1) for critical CVE-2026-98432","organization":"NetApp Product Security","sector":"Storage vendor security advisory","geography":"Global","publishedAt":"Advisory v7.0, last updated 7 November 2026 (originally published 2 November 2026)","publicationDate":"2026-11-07","eventDate":null,"sourceName":"NetApp Product Security","sourceLabel":"NetApp, Security Advisory NTAP-20261102-0001, v7.0, 7 November 2026","sourceUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"On 7 November 2026 NetApp revised NTAP-20261102-0001 to v7.0, adding E-Series SANtricity OS Controller Software 11.90R7 and 12.10R1 to Software Versions and Fixes for CVE-2026-98432, a critical (CVSS 3.1 score 9.8) Linux kernel flaw that could allow remote unauthenticated attackers to execute commands with root privileges. These are the first fix versions listed on the advisory; it remains Interim and every other Affected product (AFF/FAS BMCs and service processors, ONTAP Select Deploy, ONTAP tools for VMware vSphere 10, Cloud Volumes ONTAP Mediator, StorageGRID and the StorageGRID SG6160/SGF6112/SG110/SG1100 BMC) still has no listed fix. ONTAP 9 and AI Data Engine (AIDE) remain Not Affected; eight products, including the SG6260/SGF6212/SG120/SG1200 BMC and SolidFire/HCI nodes, remain Under Investigation.","sledRelevance":"Relevant to SLED research computing and HPC/AI storage estates that run NetApp E-Series (for example as block storage behind parallel file systems), which now have a vendor-listed remediation path. Other Affected NetApp management components in state, local and higher-education estates still have no fix, so the update narrows but does not close exposure. ONTAP 9 controllers and AIDE remain Not Affected.","evidence":"Opened the rendered advisory page via WebFetch (shows v7.0, last updated 11/07/2026, Interim, CVSS 9.8 critical, summary and impact) and the official adv_api JSON; diffed the JSON against the copy saved during the 6 November run: only fixes, revision history and update dates changed. Revision history v7.0 dated 20261107 reads 'E-Series SANtricity OS Controller Software 11.90R7 and 12.10R1 added to Software Versions and Fixes'. Vendor self-disclosure; no independent confirmation.","architectureImplications":"E-Series controllers should be scheduled for SANtricity OS 11.90R7 or 12.10R1 (vendor-listed fixes); controller firmware updates on storage behind parallel file systems typically need coordinated maintenance windows. Other Affected components still rely on management-network isolation until fixes publish (interpretation).","governanceImplications":"Record v7.0 as the first remediation milestone; keep the advisory open for remaining Affected and Under Investigation products rather than closing on the E-Series fix.","securityPrivacyImplications":"Vendor states successful exploitation could disclose sensitive information, add or modify data, or cause denial of service; remote unauthenticated root command execution on vulnerable kernels.","caveats":"Vendor self-disclosure; Interim status; fix links point to the NetApp support site (login required, not opened). The HTML advisory is an SPA shell, so fix and product tables come from the official adv_api JSON. Which E-Series releases are vulnerable versus fixed beyond the two listed versions is not stated. Repeat of an archived advisory, justified by the first published fixes.","streamIds":["netapp"],"roles":{"sales":"Use v7.0 as a remediation-ready conversation for E-Series customers, not a new alarm. NetApp now lists SANtricity OS 11.90R7 and 12.10R1 as fixes for critical CVE-2026-98432 on E-Series controllers, the first fixes on this advisory, while other Affected components such as BMCs, ONTAP Select Deploy and CVO Mediator still lack fixes. Offer to help university research-computing or agency HPC teams plan the E-Series upgrade. Do not imply ONTAP 9 or AIDE are Affected or that the whole advisory is resolved.","engineering":"Treat v7.0 as an actionable patch for E-Series SANtricity OS controllers only. Map installed SANtricity OS versions to the listed fixed releases 11.90R7 and 12.10R1, then plan controller upgrades in coordination with any parallel file system or host workloads above them. Keep management-network isolation for the still-unfixed Affected products such as BMCs, ONTAP Select Deploy, ONTAP tools for VMware vSphere 10, CVO Mediator and StorageGRID. Verify version applicability on the support site, because the advisory does not state vulnerable ranges.","delivery":"Run the E-Series upgrade as a scoped change under security operations, with research-computing storage owners executing. Gate it on support-site download access, a maintenance window and a rollback plan, then record the fixed version per controller. Keep the parent advisory ticket open for the other Affected products. The acceptance criteria below are proposals, not observed results. Risks include unplanned downtime on storage behind parallel file systems and closing the advisory too early."},"roleDetails":{"sales":{"customerProblem":"E-Series owners have carried a critical, unfixed kernel advisory since 2 November; v7.0 gives them a vendor-listed fix to schedule.","stakeholders":["CISO or security operations lead","Research computing director","Storage administrator"],"discoveryQuestions":["Do you run E-Series controllers, and on which SANtricity OS release?","Which other NTAP-20261102-0001 Affected products remain in your estate?","What maintenance window exists for storage behind your parallel file system?"],"valueHypothesis":"Fast mapping of E-Series controllers to 11.90R7 or 12.10R1 closes the one remediable part of a critical advisory (interpretation).","potentialEngagement":"A bounded E-Series SANtricity OS upgrade-planning session tied to NTAP-20261102-0001 v7.0.","unsupportedClaims":["All Affected NetApp products now have fixes","ONTAP 9 or AIDE is Affected","The flaw has been exploited against NetApp customers"]},"engineering":{"fit":"High for E-Series SANtricity OS estates; no change for ONTAP 9 or AIDE, which remain Not Affected.","architectureIntegration":"Coordinate controller firmware upgrades with hosts and file-system services on E-Series volumes; keep BMC and Mediator management planes isolated.","prerequisites":["Inventory of E-Series controllers and SANtricity OS versions","NetApp support-site access for 11.90R7 or 12.10R1"],"constraints":["Advisory still Interim","Vulnerable version ranges for E-Series not stated","Other Affected products unfixed"],"security":"Apply listed fixes; restrict management interfaces of unfixed Affected products until NetApp publishes fixes.","proofOfValue":["Each E-Series controller reports 11.90R7 or 12.10R1 or later","No unplanned I/O outage during the upgrade window"]},"delivery":{"work":"Inventory E-Series controllers, schedule and run SANtricity OS upgrades, verify versions, and keep tracking the remaining Affected products.","dependencies":["Support-site entitlement and downloads","Maintenance window agreed with research or application owners"],"ownership":"Security operations accountable; storage or research-computing team executes.","skillsAdoption":"Existing E-Series firmware upgrade skills; partner assistance where in-house experience is thin.","governanceCheckpoints":["Change approval with rollback plan","Post-upgrade version verification logged in the advisory ticket"],"acceptanceCriteria":["All E-Series controllers on a listed fixed release (proposal)","Advisory ticket stays open for remaining Affected products (proposal)"],"risks":["Downtime on storage behind parallel file systems","Premature closure of the advisory after only the E-Series fix"]}},"retrievedAt":"2026-11-07T22:06:49-06:00","enrichedAt":"2026-11-07T22:14:00-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Research computing and storage teams may need E-Series firmware upgrade skills or partner help; small campus HPC teams may lack spare change windows.","procurementImplications":"No new purchase implied; fixes are delivered through existing NetApp support entitlements (support site login required).","operatingModelImplications":"Security operations should track per-product fix status; research-computing storage owners own the E-Series upgrade.","updateExplanation":"Substantive 7 November v7.0 revision after the archived v6.0 (6 November edition): NetApp added the first Software Versions and Fixes entries on this critical advisory, E-Series SANtricity OS Controller Software 11.90R7 and 12.10R1. A JSON diff against the 6 November copy shows no other product-list changes. Canonical resource id preserved from check_sources.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","referenceExcerpt":"susceptible to a vulnerability which could allow remote unauthenticated attackers to execute commands with root privileges.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}},{"version":"external-2f455a92711e83fb131d501297da178f1eabd1e7dc59215e3d0105971fe985c3","resource":{"id":"netapp-advisory-ntap-20261102-0001-linux-kernel-tcp-rce-interim-20261102","title":"NetApp advisory NTAP-20261102-0001 v6.0: CVO Mediator and StorageGRID BMC SG6160 line moved to Affected for critical CVE-2026-98432","organization":"NetApp Product Security","sector":"Storage vendor security advisory","geography":"Global","publishedAt":"Advisory v6.0, last updated 6 November 2026","publicationDate":"2026-11-06","eventDate":null,"sourceName":"NetApp Product Security","sourceLabel":"NetApp, Security Advisory NTAP-20261102-0001, v6.0, 6 November 2026","sourceUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"On 6 November 2026 NetApp revised NTAP-20261102-0001 to v6.0 for CVE-2026-98432, a critical (CVSS 3.1 score 9.8) Linux kernel flaw that could allow remote unauthenticated root command execution. The v6.0 revision moved Cloud Volumes ONTAP Mediator and StorageGRID Baseboard Management Controller (BMC) SG6160/SGF6112/SG110/SG1100 to Affected Products, and moved StorageGRID BMC SG6060/SGF6024/SG100/SG1000 to Products Not Affected. The Affected list also continues to include numerous AFF/FAS BMCs and service processors, ONTAP Select Deploy, ONTAP tools for VMware vSphere 10, StorageGRID (formerly StorageGRID Webscale) and E-Series SANtricity OS Controller Software. Impact text still states StorageGRID does not expose any Multipath TCP (MPTCP) ports. ONTAP 9 and AIDE remain Not Affected. Status Interim; workarounds none; fixes empty.","sledRelevance":"Material for SLED operators running Cloud Volumes ONTAP Mediator or StorageGRID appliances with SG6160/SGF6112/SG110/SG1100 BMCs newly listed Affected, and for estates with AFF/FAS BMCs already in the Affected set. ONTAP 9 data controllers and AIDE remain Not Affected. Operators must reconcile StorageGRID’s Affected disposition with NetApp’s statement that StorageGRID exposes no MPTCP ports.","evidence":"Opened the rendered advisory page via WebFetch and the official adv_api JSON for NTAP-20261102-0001; read summary, impact (including StorageGRID MPTCP note), scoring, Affected/Investigating/Not Affected lists and revision history through v6.0. Vendor self-disclosure.","architectureImplications":"Inventory CVO Mediator and StorageGRID BMC generations; isolate BMC and Mediator management networks; do not treat the MPTCP non-exposure note as a substitute for following NetApp’s Affected product list and forthcoming fixes.","governanceImplications":"Document the v6.0 product moves; keep tracking until fixes publish or further Not Affected clearances arrive.","securityPrivacyImplications":"Successful exploitation could disclose sensitive information, add or modify data, or cause DoS; critical remote unauthenticated root risk on vulnerable kernels where exposed.","caveats":"Interim; no workaround or fix; StorageGRID listed Affected while impact says no MPTCP ports exposed—exposure path may be BMC/other, not MPTCP on StorageGRID services; product tables from adv_api; update of previously archived advisory.","streamIds":["netapp"],"roles":{"sales":"Use the v6.0 update as a care call for Cloud Volumes ONTAP Mediator and StorageGRID BMC SG6160/SG110-class hardware—not as an ONTAP 9 or AIDE scare. NetApp’s 6 November revision of NTAP-20261102-0001 keeps CVE-2026-98432 critical (9.8), newly lists CVO Mediator and SG6160/SGF6112/SG110/SG1100 BMCs Affected, clears the SG6060 BMC line, and still says StorageGRID exposes no MPTCP ports, with ONTAP 9 and AIDE Not Affected. Offer a bounded Mediator/BMC SKU inventory. Do not claim MPTCP exposure on StorageGRID services or that ONTAP 9 is Affected.","engineering":"Inventory Cloud Volumes ONTAP Mediator and StorageGRID BMC SG6160/SGF6112/SG110/SG1100 platforms now listed Affected, plus AFF/FAS BMCs already Affected. Isolate BMC and Mediator management planes from non-admin networks pending NetApp fixes. Reconcile the Affected StorageGRID product listing with NetApp’s MPTCP non-exposure impact note—do not ignore either statement when designing controls. Treat ONTAP 9 and AIDE as out of scope per Not Affected.","delivery":"Open or update a tracking item owned by security operations with storage and cloud-ops owners. Close when Affected Mediator/BMC products are patched or formally cleared, and record the v6.0 SKU moves in the ticket for auditors. Acceptance criteria below are proposals, not observed results. Risks include missing BMC SKU identification and over-reading the MPTCP note as a full StorageGRID all-clear."},"roleDetails":{"sales":{"customerProblem":"SLED teams need to know v6.0 newly places CVO Mediator and certain StorageGRID BMCs in the Affected set for this critical advisory.","stakeholders":["CISO","Storage manager","Cloud operations"],"discoveryQuestions":["Do you run Cloud Volumes ONTAP Mediator?","Which StorageGRID BMC generations (SG6160/SG110 vs SG6060/SG100) are in production?"],"valueHypothesis":"SKU-accurate inventory against v6.0 prevents both under- and over-reaction to the StorageGRID MPTCP note.","potentialEngagement":"A bounded Mediator/StorageGRID BMC advisory-mapping review for NTAP-20261102-0001 v6.0.","unsupportedClaims":["StorageGRID services expose MPTCP ports","ONTAP 9 or AIDE is Affected","Fixes are already published"]},"engineering":{"fit":"Estates with CVO Mediator or Affected StorageGRID/AFF/FAS BMCs; low fit for ONTAP 9/AIDE-only stacks listed Not Affected.","architectureIntegration":"Isolate Mediator and BMC management networks; track NetApp fixes per Affected SKU.","prerequisites":["Mediator inventory","StorageGRID BMC SKU map"],"constraints":["Interim advisory","No workaround or fix","Affected vs MPTCP-note tension"],"security":"Limit BMC/Mediator reachability; patch Affected products when NetApp publishes fixes.","proofOfValue":["Affected Mediator/BMC SKUs inventoried","Management planes unreachable from non-admin segments"]},"delivery":{"work":"Inventory Affected Mediator/BMC products, restrict management access, track v6.0, apply fixes when listed.","dependencies":["NetApp fixed firmware/software publication","BMC/Mediator change windows"],"ownership":"Security operations with storage and cloud-ops owners.","skillsAdoption":"No new skills; BMC SKU and Mediator inventory discipline.","governanceCheckpoints":["Change approval for BMC/Mediator updates","Close only when Affected items are cleared or patched"],"acceptanceCriteria":["CVO Mediator and SG6160/SG110-class BMCs inventoried against v6.0 (proposal)","Affected products patched or formally Not Affected (proposal)"],"risks":["Misread MPTCP note as full StorageGRID clearance","Incomplete BMC SKU inventory"]}},"retrievedAt":"2026-11-06T22:08:40-06:00","enrichedAt":"2026-11-06T22:12:30-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"SLED teams may need partner help to identify StorageGRID BMC SKUs and CVO Mediator instances.","procurementImplications":"No new purchase; existing support should cover BMC/Mediator fixes when listed.","operatingModelImplications":"Security, storage and cloud-ops owners should jointly track Mediator and StorageGRID BMC exposure.","updateExplanation":"Substantive 6 November v6.0 revision after prior archive (last covered through earlier versions including StorageGRID MPTCP non-exposure note): Cloud Volumes ONTAP Mediator and StorageGRID BMC SG6160/SGF6112/SG110/SG1100 moved to Affected; StorageGRID BMC SG6060/SGF6024/SG100/SG1000 moved to Not Affected. Canonical resource id preserved.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","referenceExcerpt":"StorageGRID does not expose any Multipath TCP (MPTCP) ports.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}},{"version":"external-261a2ef9b11c68c37b4155c256ac166274b1a4c60c0f010b2d0f19de1f3a6c64","resource":{"id":"netapp-advisory-ntap-20261102-0001-linux-kernel-tcp-rce-interim-20261102","title":"NetApp advisory NTAP-20261102-0001 v10.0: newest StorageGRID appliance BMCs (SG6260/SGF6212/SG120/SG1200) now Affected with no fix; v9.0 swaps the AFF/ASA/FAS BMC fix links","organization":"NetApp Product Security","sector":"Storage infrastructure (cross-sector)","geography":"Global","publishedAt":"Initial release 2026-11-02; v9.0 and v10.0 both dated 2026-11-10","publicationDate":"2026-11-10","eventDate":"2026-11-10","sourceName":"NetApp Product Security","sourceLabel":"Vendor security advisory (official adv_api JSON cross-checked with rendered page)","sourceUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"NetApp revised its critical Linux kernel advisory (CVE-2026-98432, CVSS 3.1 9.8, remote unauthenticated root command execution, status Interim, NetApp aware of public discussion) twice on 10 Nov. v9.0 'Corrected fix links' for the two current AFF/ASA/FAS BMC families: the JSON now maps A1K/A90/A70/C80/FAS90/FAS70 to SP_FW_308-11102_18.7P2 and A50/A30/A20/C60/C30/FAS50 to SP_FW_308-11101_19.5P2, the reverse of the v8.0 mapping. v10.0 moves StorageGRID BMC SG6260/SGF6212/SG120/SG1200 (NetApp's newest StorageGRID appliance generation) to Affected Products, with no fix listed; SG6160/SGF6112/SG110/SG1100 BMCs remain Affected without a fix. Listed fixes are still only the two AFF/ASA/FAS BMC packages and E-Series SANtricity 11.90R7/12.10R1. ONTAP 9, AIDE and Trident remain Not Affected; A250/500f/C250 BMCs and SolidFire/HCI items remain Investigating.","sledRelevance":"Interpretation: StorageGRID is used by universities, research centers and state agencies as an S3 object store for archives, backups, FabricPool tiers and AI data lakes. Owners of the newest SG6260/SGF6212/SG120/SG1200 appliances, often recent purchases, now have an exposed out-of-band management controller with no fix. Teams that scheduled AFF BMC updates from the v8.0 mapping (including from this publication's 9 Nov edition) should re-check which package applies to which platform.","evidence":"Official vendor advisory. Version 10.0, last-updated date, status, CVSS and exploitation statement confirmed on the headless-rendered advisory page; revision history, affected/fix/investigating lists and fix links read from the official adv_api JSON behind the page. KB CSG-28196 (StorageGRID) states StorageGRID exposes no MPTCP ports but the full KB requires sign-in. No independent exploitation telemetry for NetApp products was found.","architectureImplications":"StorageGRID appliance BMCs are out-of-band controllers separate from StorageGRID software nodes; NetApp's note that StorageGRID exposes no MPTCP ports refers to the software, while the appliance BMCs are listed Affected separately. Mitigation until a fix ships is management-network isolation for every appliance BMC.","governanceImplications":"Vulnerability records should track the advisory version used for decisions; a fix-link correction means change tickets created from v8.0 may reference the wrong firmware package.","securityPrivacyImplications":"Critical remote root execution on management controllers of the newest StorageGRID appliances, with no fix; restrict BMC interfaces to isolated admin networks and verify firmware packages against platform before applying AFF BMC updates.","caveats":"Vendor-claim advisory; status Interim and lists may change again. The rendered page shows only the overview tab, so revision and fix details come from the JSON endpoint. Firmware package names are inferred from download file names. The swap is inferred by comparing the 10 Nov JSON with the 9 Nov JSON saved by the previous run; NetApp's revision note says only 'Corrected fix links'. SG6260/SGF6212/SG120/SG1200 being the newest generation is interpretation from NetApp's model numbering.","streamIds":["netapp"],"roles":{"sales":"Sales framing: this is a service-quality touchpoint for StorageGRID and AFF customers. Account teams should proactively tell SLED customers that the newest StorageGRID appliances now appear on a critical advisory without a fix, and that the AFF BMC fix links were corrected, so any firmware planned from earlier guidance needs re-checking. Position help with inventory and network isolation, not upgrades or replacements; the advisory gives no end-of-support or fix date.","engineering":"Engineering framing: re-map every customer platform to the v10.0 JSON. Confirm StorageGRID appliance models; SG6260/SGF6212/SG120/SG1200 and SG6160/SGF6112/SG110/SG1100 BMCs are Affected with no fix, so verify BMC ports are reachable only from admin subnets. For AFF/ASA/FAS, check the firmware package against the platform before upload, because v9.0 swapped which package maps to the A1K and A50 families. ONTAP 9 itself remains Not Affected.","delivery":"Delivery framing: update the remediation tracker. Pull back any queued AFF/ASA/FAS BMC change tickets built on v8.0 links and re-validate package-to-platform mapping. Add the newest StorageGRID appliances to the 'affected, no fix' exception list with documented compensating controls, and schedule a re-check on every advisory revision. Close items only after installed firmware is verified on each controller and BMC network exposure is confirmed by scan."},"roleDetails":{"sales":{"customerProblem":"Customers with new StorageGRID appliances or current AFF/ASA/FAS systems may hold outdated remediation plans for a critical remote root vulnerability.","stakeholders":["Storage/object-storage administrators","CISO or security office","Research data or archive owners","Change advisory board"],"discoveryQuestions":["Which StorageGRID appliance models are deployed (SG6260/SGF6212/SG120/SG1200 or SG6160/SGF6112/SG110/SG1100)?","Are appliance BMCs on an isolated management network?","Were AFF/ASA/FAS BMC updates planned or applied using the v8.0 fix links?","Who tracks advisory versions in your vulnerability program?"],"valueHypothesis":"A short re-validation can prevent mis-applied firmware on current AFF systems and document compensating controls for unfixed StorageGRID BMCs.","potentialEngagement":"A bounded advisory re-mapping and BMC exposure review across AFF/ASA/FAS and StorageGRID appliances.","unsupportedClaims":["That StorageGRID appliances have a fix","Any date for a StorageGRID BMC fix","Exploitation against NetApp customers","That ONTAP upgrades address this CVE"]},"engineering":{"fit":"Applies to customers with StorageGRID SG6260/SGF6212/SG120/SG1200 or SG6160/SGF6112/SG110/SG1100 appliances and current AFF/ASA/FAS A1K or A50-class systems.","architectureIntegration":"BMC firmware is separate from ONTAP and StorageGRID software; mitigation for unfixed appliances is network isolation of BMC interfaces.","prerequisites":["Appliance and controller inventory by model","Access to the v10.0 advisory JSON or Remediation tab","Management-network topology","NetApp Support download access"],"constraints":["No fix for StorageGRID appliance BMCs","Fix-link mapping changed between v8.0 and v9.0","KB CSG-28196 full content requires sign-in"],"security":"CVSS 9.8 remote unauthenticated root execution on BMCs; isolate and restrict source addresses until fixed; verify package-to-platform before flashing.","proofOfValue":["Confirm installed AFF BMC firmware matches the v9.0+ mapping","Scan to verify StorageGRID BMC ports are unreachable from user networks","Re-check advisory version before closing each change"]},"delivery":{"work":"Re-validate queued AFF BMC firmware changes, add newest StorageGRID appliances to exceptions with compensating controls, and re-check on each advisory revision.","dependencies":["Customer change approvals","Network team for BMC isolation","NetApp Support account"],"ownership":"Customer storage operations owns firmware and appliance changes; security office owns exception acceptance.","skillsAdoption":"Operators must handle BMC firmware for both AFF controllers and StorageGRID appliances, which follow different procedures from software upgrades.","governanceCheckpoints":["Re-approval of any change built on v8.0 links","Exception sign-off for StorageGRID appliance BMCs","Advisory-version check at closure"],"acceptanceCriteria":["100% of planned AFF BMC updates re-validated against v9.0+ mapping","Every affected StorageGRID appliance BMC has a documented compensating control","BMC interfaces reachable only from approved admin subnets"],"risks":["Applying the wrong firmware package to a controller","Further advisory changes after closure","Flat management networks exposing BMCs"]}},"retrievedAt":"2026-11-11T04:03:16Z","enrichedAt":"2026-11-11T04:06:28Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Adds out-of-band firmware and exception tracking to storage teams' patch load; no accessibility content.","procurementImplications":"Recently purchased StorageGRID appliances are affected without a fix; buyers may raise remediation timelines in support discussions, but the advisory does not justify replacement.","operatingModelImplications":"Advisory revisions can change fix mappings; operations should tie each change ticket to a specific advisory version.","updateExplanation":"Archived at v8.0 (9 Nov), which mapped A1K/A90/A70/C80/FAS90/FAS70 to SP_FW_308-11101_19.5P2 and A50/A30/A20/C60/C30/FAS50 to SP_FW_308-11102_18.7P2. v9.0 (10 Nov) 'Corrected fix links', and the 10 Nov JSON now reverses that mapping, correcting what our 9 Nov edition reported. v10.0 (10 Nov) adds StorageGRID BMC SG6260/SGF6212/SG120/SG1200 to Affected Products with no fix. Not Affected status for ONTAP 9, AIDE and Trident re-verified.","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","referenceExcerpt":"NetApp is aware of public discussion of this vulnerability.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}},{"version":"external-1ae3048dcdf73dfd88a8745f10021692d203fe3667d51bc81b59d6b20f50a36d","resource":{"id":"netapp-advisory-ntap-20261102-0001-linux-kernel-tcp-rce-interim-20261102","title":"NetApp updates NTAP-20261102-0001 to v4.0: StorageGRID does not expose MPTCP ports for critical Linux kernel flaw CVE-2026-98432","organization":"NetApp Product Security","sector":"Storage vendor security advisory","geography":"Global","publishedAt":"Advisory v4.0, last updated 3 November 2026","publicationDate":"2026-11-03","eventDate":null,"sourceName":"NetApp Product Security","sourceLabel":"NetApp, Security Advisory NTAP-20261102-0001, Advisory v4.0, last updated 3 November 2026","sourceUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"NetApp updated interim advisory NTAP-20261102-0001 to version 4.0 on 3 November. The advisory covers CVE-2026-98432, a critical (CVSS 3.1 9.8) Linux kernel flaw that could allow remote unauthenticated root command execution. The new version adds that StorageGRID does not expose any Multipath TCP (MPTCP) ports. The advisory is still interim, NetApp is aware of public discussion, and other NetApp products are not yet mapped in the rendered page.","sledRelevance":"Gives SLED StorageGRID owners a partial answer on exposure to the kernel flaw covered on 2 November, but ONTAP, appliance and management-software owners still lack a product list and should keep watching the advisory.","evidence":"Opened the rendered v4.0 page and compared it with the v2.0 content archived on 2 November. Vendor self-disclosure.","architectureImplications":"No change beyond StorageGRID exposure statement.","governanceImplications":"Keep the advisory on watch until it moves to final.","securityPrivacyImplications":"StorageGRID exposure reduced per NetApp; other products unknown.","caveats":"Interim; StorageGRID statement is vendor-asserted; other products unmapped.","streamIds":["netapp"],"roles":{"sales":"Use this to update customers you briefed on 2 November. NetApp now says StorageGRID does not expose the Multipath TCP ports involved in the critical Linux kernel flaw CVE-2026-98432. Do not extend that assurance to ONTAP or other products; the advisory is still interim.","engineering":"Record StorageGRID as not exposed per NetApp v4.0, and keep tracking other NetApp products on Linux kernels. Continue network hardening, for example blocking MPTCP where not needed, until NetApp lists affected and fixed products.","delivery":"Update the open tracking item from 2 November rather than opening new work. Security operations owns monitoring until the advisory is final. Acceptance criteria below are proposals."},"roleDetails":{"sales":{"customerProblem":"Customers need to know which NetApp products the critical kernel flaw affects.","stakeholders":["CISO","Storage manager"],"discoveryQuestions":["Which NetApp products do you run besides StorageGRID?","Is MPTCP blocked at your network edge?"],"valueHypothesis":"Timely, accurate updates keep trust.","potentialEngagement":"Advisory-tracking update for existing customers.","unsupportedClaims":["Any NetApp product other than StorageGRID is unaffected"]},"engineering":{"fit":"All NetApp customers on Linux-based products.","architectureIntegration":"No change.","prerequisites":["Product inventory"],"constraints":["Interim advisory"],"security":"Block unnecessary MPTCP; watch advisory.","proofOfValue":["Inventory mapped to final advisory"]},"delivery":{"work":"Update tracking item.","dependencies":["Final NetApp advisory"],"ownership":"Security operations.","skillsAdoption":"None new.","governanceCheckpoints":["Close item only when advisory is final"],"acceptanceCriteria":["All products mapped to final advisory (proposal)"],"risks":["Assuming non-StorageGRID products are safe"]}},"retrievedAt":"2026-11-03T22:12:00-06:00","enrichedAt":"2026-11-03T22:25:00-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Storage teams may need vendor or partner help to schedule upgrades.","procurementImplications":"No procurement change; existing support contracts cover fixes.","operatingModelImplications":"Storage and security teams should coordinate patch windows and log review.","updateExplanation":"Previously archived on 2 November as v2.0 with no products listed. Version 4.0 (updated 3 November) adds a StorageGRID statement that it does not expose MPTCP ports; this is the only material change found.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","referenceExcerpt":"StorageGRID does not expose any Multipath TCP (MPTCP) ports.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}},{"version":"external-0a7911c88338ab4adc7d3f9ae7cd09c703e311cbcbeff88050f2399769c40ebf","resource":{"id":"netapp-advisory-ntap-20261102-0001-linux-kernel-tcp-rce-interim-20261102","title":"NetApp advisory NTAP-20261102-0001 v8.0: BMC firmware fixes published for current AFF/ASA/FAS A1K-A90-A70 and A50-A30-A20 families on critical CVE-2026-98432","organization":"NetApp Product Security","sector":"Storage infrastructure (cross-sector)","geography":"Global","publishedAt":"Initial release 2026-11-02; v8.0 last updated 2026-11-09","publicationDate":"2026-11-09","eventDate":"2026-11-09","sourceName":"NetApp Product Security","sourceLabel":"Vendor security advisory (official adv_api JSON cross-checked with rendered page)","sourceUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"Version 8.0 (last updated 11/09/2026) of NetApp's critical Linux kernel advisory (CVE-2026-98432, CVSS 3.1 9.8, remote unauthenticated root command execution, status Interim) adds Software Versions and Fixes for two current controller families' BMCs: AFF/ASA/FAS A1K/A90/A70/C80/FAS90/FAS70 (firmware package SP_FW_308-11101_19.5P2) and A50/A30/A20/C60/C30/FAS50 (SP_FW_308-11102_18.7P2). E-Series SANtricity OS 11.90R7/12.10R1 remain the other listed fixes. Affected products without a listed fix still include older BMC/SP families (A700s, 8300/8700/A400/C400, A320, A800/C800, A900/9500, C190/A150/A220/FAS2720/FAS2750, FAS2820, A300/8200, A700/9000), Cloud Volumes ONTAP Mediator, ONTAP Select Deploy, ONTAP tools for VMware vSphere 10, StorageGRID and StorageGRID BMC SG6160/SGF6112/SG110/SG1100. ONTAP 9, AIDE and Trident remain Not Affected.","sledRelevance":"Interpretation: the A90/A70/A1K and A50/A30/A20 families are NetApp's current AFF/ASA platforms that SLED buyers are procuring for AI and general storage; their out-of-band BMCs now have a fix path, so patch windows can be scheduled. Owners of older arrays still in service at counties, universities and school districts remain without a listed fix and must rely on BMC network isolation.","evidence":"Official vendor advisory. Product lists, fix links and revision history taken from the official adv_api JSON endpoint behind the advisory SPA; version, date, summary and CVSS confirmed on the headless-rendered advisory page. No independent exploitation telemetry for NetApp products was found; NetApp states it is aware of public discussion.","architectureImplications":"BMCs are out-of-band management controllers; the fix is firmware separate from ONTAP upgrades, so plan a distinct maintenance step per HA pair. StorageGRID is listed Affected but NetApp notes it exposes no MPTCP ports and points to KB CSG-28196.","governanceImplications":"Vulnerability-management programs should record which arrays now have a vendor fix versus those still Interim with no fix, and track exceptions for the latter.","securityPrivacyImplications":"Critical remote root execution on management controllers; until patched, restrict BMC/SP interfaces to isolated management networks. Fix availability is staggered by hardware family.","caveats":"Vendor-claim advisory; status remains Interim and lists may change. Fix firmware version strings are inferred from NetApp Support download file names in the JSON, not from release notes. Hardware-to-AI-deployment linkage is interpretation.","streamIds":["netapp"],"roles":{"sales":"Sales framing: use this as a trust-building service touchpoint, not a pitch. Customers running current A-series or A50-class arrays now have a vendor fix for the BMC exposure on a critical CVE; offer help scheduling firmware updates. For customers on older families still without a fix, be candid that the advisory is Interim and discuss compensating controls. Do not frame the gap as a reason to replace hardware unless lifecycle evidence supports it; the advisory says nothing about end of support.","engineering":"Engineering framing: map each customer array to the advisory's product names, then separate 'fix available' (A1K/A90/A70/C80/FAS90/FAS70, A50/A30/A20/C60/C30/FAS50 BMCs, E-Series) from 'affected, no fix'. Validate the firmware package against the platform before upload, and confirm BMC interfaces are on an isolated management VLAN with ACLs. StorageGRID notes no MPTCP exposure; confirm with the referenced KB. ONTAP 9 itself is Not Affected, so no ONTAP upgrade is implied.","delivery":"Delivery framing: run a two-track remediation. Track one schedules BMC firmware updates for newly fixed families with change control and rollback notes. Track two documents compensating controls and exceptions for affected products without fixes, with a re-check whenever NetApp revises the advisory. Report status to the customer's security office using the advisory version number so both sides reference the same state, and close the work only after firmware versions are verified on every in-scope controller."},"roleDetails":{"sales":{"customerProblem":"Customers need to know whether their specific NetApp arrays are exposed to a critical remote root vulnerability and whether a fix exists.","stakeholders":["Infrastructure/storage manager","CISO or security office","Change advisory board","Data center operations"],"discoveryQuestions":["Which AFF/ASA/FAS models and BMC firmware versions are deployed?","Are BMC/SP interfaces on an isolated management network?","Which arrays fall in families still without a listed fix?","Who tracks vendor advisory versions for exceptions?"],"valueHypothesis":"Structured mapping and scheduling can shorten time-to-remediation for fixable arrays and document compensating controls for the rest.","potentialEngagement":"A bounded advisory-mapping and firmware-update support engagement for in-scope arrays.","unsupportedClaims":["That all NetApp products are fixed","That ONTAP upgrades address this CVE (ONTAP 9 is Not Affected)","Any evidence of exploitation against NetApp customers","That older arrays must be replaced"]},"engineering":{"fit":"Applies to any customer with listed Affected NetApp hardware management controllers or software components.","architectureIntegration":"BMC firmware is updated out of band from ONTAP; E-Series fixes are SANtricity OS releases; StorageGRID has a KB workaround reference.","prerequisites":["Accurate hardware inventory by model family","Access to NetApp Support downloads","Maintenance windows per HA pair","Management-network topology documentation"],"constraints":["Status Interim; no fix for many older BMC/SP families","Firmware applies per platform family","Customer change windows in academic or election periods"],"security":"Critical CVSS 9.8 remote unauthenticated root execution; isolate BMC/SP interfaces and restrict source addresses until patched.","proofOfValue":["Confirm installed BMC firmware matches the fixed package after update","Scan management network to verify BMC exposure limited to admin hosts","Re-check advisory version before closing the change"]},"delivery":{"work":"Inventory, firmware update for fixable families, and documented exceptions with compensating controls for unfixed products.","dependencies":["Customer change approvals","NetApp Support account access","Network team for management-VLAN controls"],"ownership":"Customer storage operations owns patching; security office owns exception acceptance.","skillsAdoption":"Operators need familiarity with BMC/SP firmware procedures distinct from ONTAP upgrades.","governanceCheckpoints":["Change approval per maintenance window","Exception sign-off for unfixed products","Advisory-version re-check at closure"],"acceptanceCriteria":["100% of fixable in-scope BMCs on the listed firmware","Every unfixed affected product has a documented compensating control","BMC interfaces reachable only from approved admin subnets"],"risks":["Firmware update failure on a controller","Advisory lists changing after closure","Unknown BMC exposure on flat networks"]}},"retrievedAt":"2026-11-10T04:11:51Z","enrichedAt":"2026-11-10T04:15:19Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Adds out-of-band firmware work to storage teams' patch load; no accessibility content.","procurementImplications":"Fix availability by hardware family may inform lifecycle and support-renewal discussions but does not by itself justify replacement.","operatingModelImplications":"Advisory versions change frequently; operations should tie status reports to a specific advisory version.","updateExplanation":"Archived at v7.0 (7 Nov), when E-Series SANtricity 11.90R7/12.10R1 were the only fixes. v8.0 (9 Nov) adds the first BMC firmware fixes, for the AFF/ASA/FAS A1K/A90/A70/C80/FAS90/FAS70 and A50/A30/A20/C60/C30/FAS50 families, the current controller lines. Affected-without-fix list and Not Affected status for ONTAP 9/AIDE/Trident re-verified from the 9 Nov JSON.","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/ntap-20261102-0001","referenceExcerpt":"susceptible to a vulnerability which could allow remote unauthenticated attackers to execute commands with root privileges.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}