{"resourceId":"netapp-advisory-ntap-20261106-0012-freebsd-ontap9-affected-20261106","versions":[{"version":"external-2f455a92711e83fb131d501297da178f1eabd1e7dc59215e3d0105971fe985c3","resource":{"id":"netapp-advisory-ntap-20261106-0012-freebsd-ontap9-affected-20261106","title":"NetApp advisory NTAP-20261106-0012: FreeBSD CVE-2026-101307 HIGH 8.2; ONTAP 9 Affected, no fix yet","organization":"NetApp Product Security","sector":"Storage vendor security advisory","geography":"Global","publishedAt":"Advisory v1.0, last updated 6 November 2026","publicationDate":"2026-11-06","eventDate":null,"sourceName":"NetApp Product Security","sourceLabel":"NetApp, Security Advisory NTAP-20261106-0012, v1.0, 6 November 2026","sourceUrl":"https://security.netapp.com/advisory/ntap-20261106-0012","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"On 6 November 2026 NetApp published interim NTAP-20261106-0012 v1.0 for CVE-2026-101307: FreeBSD 15.1 can allow a remote attacker to trigger an out-of-bounds write in the kernel heap resulting in a kernel panic. CVSS 4.0 scores it HIGH 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). The official advisory API lists ONTAP 9 under Affected Products and an empty Investigating list. AI Data Engine (AIDE), StorageGRID, SnapCenter, ONTAP Select Deploy and Cloud Volumes ONTAP Mediator appear on Not Affected. Status Interim; exploitation discussion Public; workarounds none at this time; fixes list empty.","sledRelevance":"Directly relevant to SLED agencies and campuses whose primary NetApp estate is ONTAP 9—the product NetApp lists as Affected—while AIDE AI-metadata stacks and StorageGRID object estates are listed Not Affected. Owners should treat this as a controller/DoS patch-readiness issue, not as confirmation that every ONTAP 9 release string is equally exposed (NetApp does not publish per-release mapping here).","evidence":"Opened the rendered advisory page via WebFetch and the official adv_api JSON for NTAP-20261106-0012; read summary, impact, scoring, Affected/Not Affected lists and revision history. Vendor self-disclosure; FreeBSD-SA-26:70.tcp referenced.","architectureImplications":"Prioritize ONTAP 9 patch planning and management-plane network controls for TCP-facing paths once NetApp publishes fixed releases; do not assume AIDE or StorageGRID inherit this ONTAP 9 disposition.","governanceImplications":"Track Interim status until fixes appear or product disposition changes; document ONTAP 9 versions in inventory against forthcoming fixed releases.","securityPrivacyImplications":"Successful exploitation could cause Denial of Service via kernel panic; confidentiality/integrity impacts are not claimed in the scoring vector (VA:H only).","caveats":"Interim; no workaround or fix versions; FreeBSD 15.1 to specific ONTAP 9 release mapping not stated; product tables from adv_api because the HTML SPA omits them; vendor self-assessment.","streamIds":["netapp"],"roles":{"sales":"Use this as an urgent care call for ONTAP 9 customers, not as an AIDE or StorageGRID pitch. NetApp’s 6 November NTAP-20261106-0012 rates FreeBSD CVE-2026-101307 HIGH (8.2) and lists ONTAP 9 Affected with no workaround or fix yet, while AIDE and StorageGRID are Not Affected. Offer a short ONTAP 9 inventory and patch-readiness check. Do not claim active SLED exploitation, that AIDE is affected, or that fixed release strings are already published.","engineering":"Inventory ONTAP 9 clusters against the Affected listing and confirm management and data-path TCP exposure relevant to the FreeBSD TCP advisory NetApp cites. Prefer isolating unnecessary remote access to controllers until NetApp publishes fixed versions, and keep a change-window plan ready so upgrades can proceed without waiting for a workaround that the advisory says does not exist. Treat AIDE and StorageGRID as out of scope per Not Affected, and re-check when the advisory leaves Interim or adds fixes.","delivery":"Open a tracking item owned by security operations with the storage owner. Close it only when listed ONTAP 9 systems are upgraded to NetApp-published fixed releases or the product is formally cleared, and keep leadership informed that no workaround is available in the meantime. Acceptance criteria below are proposals, not observed results. Main risks are incomplete ONTAP version inventory and delaying change windows because no workaround exists."},"roleDetails":{"sales":{"customerProblem":"SLED teams running ONTAP 9 need to know they are in the Affected set for this FreeBSD DoS advisory with no fix yet.","stakeholders":["CISO","Storage manager","Security operations"],"discoveryQuestions":["Which ONTAP 9 versions and clusters do you operate?","Who owns the next ONTAP upgrade change window?"],"valueHypothesis":"Early inventory against NetApp’s Affected list shortens time-to-patch once fixes publish.","potentialEngagement":"A bounded ONTAP 9 advisory-mapping and patch-readiness review for NTAP-20261106-0012.","unsupportedClaims":["Active exploitation in SLED","AIDE or StorageGRID is Affected","Fixed ONTAP release strings are already available"]},"engineering":{"fit":"SLED estates with ONTAP 9; low fit for AIDE-only or StorageGRID-only stacks listed Not Affected.","architectureIntegration":"Plan ONTAP 9 upgrades when fixes list; tighten remote management exposure meanwhile.","prerequisites":["ONTAP 9 version inventory","Change-window calendar"],"constraints":["Interim advisory","No published workaround","Empty fixes list"],"security":"Limit unnecessary remote reachability to ONTAP management/data services until patched.","proofOfValue":["All ONTAP 9 clusters mapped to the Affected listing","Upgrade plan staged for NetApp fixed releases when published"]},"delivery":{"work":"Inventory ONTAP 9, track the advisory, apply NetApp-listed fixes when available.","dependencies":["NetApp fixed release publication","Approved ONTAP change window"],"ownership":"Security operations with the storage owner.","skillsAdoption":"No new skills; standard ONTAP upgrade discipline.","governanceCheckpoints":["Change approval for ONTAP upgrades","Close only when Affected systems are patched or cleared"],"acceptanceCriteria":["ONTAP 9 inventory complete against v1.0 Affected list (proposal)","Clusters on NetApp-published fixed releases or formally Not Affected (proposal)"],"risks":["Incomplete version inventory","Change-window delay while no workaround exists"]}},"retrievedAt":"2026-11-06T22:08:12-06:00","enrichedAt":"2026-11-06T22:12:30-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Small SLED shops may need partner help to map ONTAP 9 versions and schedule non-disruptive upgrades once fixes list.","procurementImplications":"No new purchase signal; existing support contracts should cover forthcoming ONTAP 9 fixes.","operatingModelImplications":"Security operations and storage owners should jointly track ONTAP 9 advisory disposition and change windows.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/ntap-20261106-0012","referenceExcerpt":"FreeBSD version 15.1 is susceptible to a vulnerability which when successfully exploited could allow a remote attacker","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}