https://sled.lighthouseadvisory.consulting/feeds/netapp.xml2026-11-11T05:15:58.568ZLighthouse Advisoryhttps://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-11-102026-11-11T05:15:58.568Z2026-11-10T00:00:00.000Z

Two vendor-sourced NetApp signals for 10 November; no new U.S. SLED deployment evidence. NetApp named Netherlands-based Nebul as the first neocloud to adopt Novus and said Novus is generally available. The release gives no performance, scale or contract figures, independent commentary still calls the 100 TB/s figure unbenchmarked, and Nebul also runs DDN storage, so U.S. public-sector relevance is limited. NetApp's critical kernel advisory NTAP-20261102-0001 changed twice. v10.0 adds the newest StorageGRID appliance BMCs (SG6260/SGF6212/SG120/SG1200) as Affected with no fix. v9.0 corrected the AFF/ASA/FAS BMC fix links, reversing the A1K-family and A50-family firmware mapping reported in the 9 November edition.

Two vendor-sourced NetApp signals for 10 November; no new U.S. SLED deployment evidence. NetApp named Netherlands-based Nebul as the first neocloud to adopt Novus and said Novus is generally available. The release gives no performance, scale or contract figures, independent commentary still calls the 100 TB/s figure unbenchmarked, and Nebul also runs DDN storage, so U.S. public-sector relevance is limited. NetApp's critical kernel advisory NTAP-20261102-0001 changed twice. v10.0 adds the newest StorageGRID appliance BMCs (SG6260/SGF6212/SG120/SG1200) as Affected with no fix. v9.0 corrected the AFF/ASA/FAS BMC fix links, reversing the A1K-family and A50-family firmware mapping reported in the 9 November edition. 2 sources · 0 cross-source patternshttps://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-11-092026-11-10T11:25:11.968Z2026-11-09T00:00:00.000Z

Three vendor-sourced NetApp signals for 9 November; no new independent SLED deployment evidence. AWS extended S3 Access Points for FSx for NetApp ONTAP to four more Regions, letting AI services such as Bedrock Knowledge Bases read ONTAP file data in place. The AWS user guide does not mark GovCloud as supported and lists unsupported S3 features such as Object Lock and versioning. NetApp's critical kernel advisory NTAP-20261102-0001 v8.0 adds the first BMC firmware fixes for current A1K/A90/A70 and A50/A30/A20 families, while older BMCs, Select Deploy and StorageGRID remain unfixed. The eMudhra CA compromise advisory (v9.0) keeps ONTAP 9 below 9.18.1, StorageGRID and Trident Affected with workarounds, and AIDE still under investigation.

Three vendor-sourced NetApp signals for 9 November; no new independent SLED deployment evidence. AWS extended S3 Access Points for FSx for NetApp ONTAP to four more Regions, letting AI services such as Bedrock Knowledge Bases read ONTAP file data in place. The AWS user guide does not mark GovCloud as supported and lists unsupported S3 features such as Object Lock and versioning. NetApp's critical kernel advisory NTAP-20261102-0001 v8.0 adds the first BMC firmware fixes for current A1K/A90/A70 and A50/A30/A20 families, while older BMCs, Select Deploy and StorageGRID remain unfixed. The eMudhra CA compromise advisory (v9.0) keeps ONTAP 9 below 9.18.1, StorageGRID and Trident Affected with workarounds, and AIDE still under investigation. 3 sources · 1 cross-source patterns 9 Nov advisory revisions add hardware/E-Series fixes while software exposure stays on workarounds Does our vulnerability tracker record NetApp advisory status by product family and advisory version, with compensating controls for affected items still lacking a fix?https://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-11-082026-11-09T05:14:50.038Z2026-11-08T00:00:00.000Z

Two NetApp items for 8 November. Cyber Magazine's new report on the completed PEAK:AIO deal adds that PEAK's technology traces to Los Alamos and Carnegie Mellon research needs and restates existing ONTAP ARP/AI and multi-admin protections, but is mostly vendor quotes. An ITdaily report from 29 September is newly relevant as a check on those claims: Novus's 100 TB/s figure is a NetApp and Omdia projection that practice has yet to prove. No new SLED NetApp AI deployment evidence, and no new NetApp advisory change, appeared.

Two NetApp items for 8 November. Cyber Magazine's new report on the completed PEAK:AIO deal adds that PEAK's technology traces to Los Alamos and Carnegie Mellon research needs and restates existing ONTAP ARP/AI and multi-admin protections, but is mostly vendor quotes. An ITdaily report from 29 September is newly relevant as a check on those claims: Novus's 100 TB/s figure is a NetApp and Omdia projection that practice has yet to prove. No new SLED NetApp AI deployment evidence, and no new NetApp advisory change, appeared. 2 sources · 0 cross-source patternshttps://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-11-072026-11-08T05:04:12.491Z2026-11-07T00:00:00.000Z

Thin vendor-sourced NetApp signal for 7 November; no new independent SLED deployment evidence. NetApp revised critical Linux kernel advisory NTAP-20261102-0001 (CVE-2026-98432, CVSS 9.8) to v7.0. It lists the advisory's first fixes, E-Series SANtricity OS 11.90R7 and 12.10R1, while other Affected products such as BMCs, ONTAP Select Deploy, CVO Mediator and StorageGRID remain unfixed, and ONTAP 9 and AIDE stay Not Affected. Separately, NetApp's ONTAP 9.20.1 release notes for AFX (dated 5 November, not previously covered) describe full enterprise feature support at 32 nodes, FabricPool tiering, directories of about 25 million files for AI training, and lower default ARP/AI periodic snapshot retention after upgrade. NetApp provides no benchmark for these changes.

Thin vendor-sourced NetApp signal for 7 November; no new independent SLED deployment evidence. NetApp revised critical Linux kernel advisory NTAP-20261102-0001 (CVE-2026-98432, CVSS 9.8) to v7.0. It lists the advisory's first fixes, E-Series SANtricity OS 11.90R7 and 12.10R1, while other Affected products such as BMCs, ONTAP Select Deploy, CVO Mediator and StorageGRID remain unfixed, and ONTAP 9 and AIDE stay Not Affected. Separately, NetApp's ONTAP 9.20.1 release notes for AFX (dated 5 November, not previously covered) describe full enterprise feature support at 32 nodes, FabricPool tiering, directories of about 25 million files for AI training, and lower default ARP/AI periodic snapshot retention after upgrade. NetApp provides no benchmark for these changes. 2 sources · 0 cross-source patternshttps://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-11-062026-11-07T05:47:59.330Z2026-11-06T00:00:00.000Z

Three NetApp Product Security signals on 6 November. New interim NTAP-20261106-0012 lists ONTAP 9 Affected for FreeBSD CVE-2026-101307 (CVSS 4.0 HIGH 8.2 remote kernel panic) with no workaround or fix, while AIDE and StorageGRID are Not Affected. New interim NTAP-20261106-0001 lists ONTAP Select Deploy Affected for Linux kernel CVE-2026-72493 (CVSS 3.1 CRITICAL 9.9) and keeps Console Agent OVA, SolidFire/HCI and SnapCenter VMware plugin under Investigating, with ONTAP 9 Not Affected. Archived NTAP-20261102-0001 revised to v6.0 moves Cloud Volumes ONTAP Mediator and StorageGRID BMC SG6160/SGF6112/SG110/SG1100 to Affected (SG6060 BMC line Not Affected) for critical CVE-2026-98432, while still stating StorageGRID exposes no MPTCP ports.

Three NetApp Product Security signals on 6 November. New interim NTAP-20261106-0012 lists ONTAP 9 Affected for FreeBSD CVE-2026-101307 (CVSS 4.0 HIGH 8.2 remote kernel panic) with no workaround or fix, while AIDE and StorageGRID are Not Affected. New interim NTAP-20261106-0001 lists ONTAP Select Deploy Affected for Linux kernel CVE-2026-72493 (CVSS 3.1 CRITICAL 9.9) and keeps Console Agent OVA, SolidFire/HCI and SnapCenter VMware plugin under Investigating, with ONTAP 9 Not Affected. Archived NTAP-20261102-0001 revised to v6.0 moves Cloud Volumes ONTAP Mediator and StorageGRID BMC SG6160/SGF6112/SG110/SG1100 to Affected (SG6060 BMC line Not Affected) for critical CVE-2026-98432, while still stating StorageGRID exposes no MPTCP ports. 3 sources · 1 cross-source patterns 6 November NetApp advisories list core products Affected without fixes Which ONTAP 9 clusters and ONTAP Select Deploy instances do we run, and can non-admin networks reach their management planes?https://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-11-052026-11-06T11:55:49.650Z2026-11-05T00:00:00.000Z

Two NetApp Product Security advisories revised on 5 November. NTAP-20261104-0005 (rsync PROXY IP spoof, critical 9.1) clears AFF BMC A700s while leaving older BMC and SolidFire/HCI products under Investigating; ONTAP 9 and AIDE are Not Affected. NTAP-20261030-0015 (PyJWT, critical 9.1) clears the ransomware-protection Console Agent container and keeps Console compliance/OVA, Data Classification, SolidFire/HCI and XCP under Investigating, again with AIDE and ONTAP 9 Not Affected. Both remain Interim with empty Affected lists and no workarounds—SLED owners should inventory Investigating components and isolate management planes.

Two NetApp Product Security advisories revised on 5 November. NTAP-20261104-0005 (rsync PROXY IP spoof, critical 9.1) clears AFF BMC A700s while leaving older BMC and SolidFire/HCI products under Investigating; ONTAP 9 and AIDE are Not Affected. NTAP-20261030-0015 (PyJWT, critical 9.1) clears the ransomware-protection Console Agent container and keeps Console compliance/OVA, Data Classification, SolidFire/HCI and XCP under Investigating, again with AIDE and ONTAP 9 Not Affected. Both remain Interim with empty Affected lists and no workarounds—SLED owners should inventory Investigating components and isolate management planes. 2 sources · 1 cross-source patterns 5 November NetApp advisories stay interim with empty Affected lists Which Investigating NetApp BMC, HCI, Console Agent or XCP components do we still run, and can non-admin networks reach them?https://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-11-042026-11-05T05:43:13.968Z2026-11-04T00:00:00.000Z

Two NetApp items for 4 November. NetApp marked an NGINX flaw (CVE-2026-15176) critical in an interim advisory that does not yet list affected NetApp products, so SLED customers should restrict management interfaces and watch for fixes. With the PEAK:AIO deal now closed, an independent Futurum analysis is newly relevant: it says Novus rests on design targets, not benchmarks, and raises agent-governance questions for the Console. No new SLED NetApp AI deployment evidence appeared.

Two NetApp items for 4 November. NetApp marked an NGINX flaw (CVE-2026-15176) critical in an interim advisory that does not yet list affected NetApp products, so SLED customers should restrict management interfaces and watch for fixes. With the PEAK:AIO deal now closed, an independent Futurum analysis is newly relevant: it says Novus rests on design targets, not benchmarks, and raises agent-governance questions for the Console. No new SLED NetApp AI deployment evidence appeared. 2 sources · 0 cross-source patternshttps://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-11-032026-11-04T15:01:53.035Z2026-11-03T00:00:00.000Z

Three NetApp security items for 3 November, all relevant to SLED storage operations rather than new AI deployments. NetApp disclosed two StorageGRID authentication-bypass flaws: a critical one (CVE-2026-22058) needing Grid Network access and a medium one (CVE-2026-22060) affecting all versions in default configurations. It also updated its interim Linux kernel advisory to say StorageGRID does not expose the affected MPTCP ports. Agencies and campuses using StorageGRID for backups, research or AI data should check Grid Network isolation and plan upgrades. No new SLED NetApp AI deployment evidence appeared.

Three NetApp security items for 3 November, all relevant to SLED storage operations rather than new AI deployments. NetApp disclosed two StorageGRID authentication-bypass flaws: a critical one (CVE-2026-22058) needing Grid Network access and a medium one (CVE-2026-22060) affecting all versions in default configurations. It also updated its interim Linux kernel advisory to say StorageGRID does not expose the affected MPTCP ports. Agencies and campuses using StorageGRID for backups, research or AI data should check Grid Network isolation and plan upgrades. No new SLED NetApp AI deployment evidence appeared. 3 sources · 1 cross-source patterns StorageGRID risk this week depends on Grid Network isolation Can each SLED StorageGRID owner show that its Grid Network is unreachable from non-grid segments?https://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-11-022026-11-03T11:43:38.440Z2026-11-02T00:00:00.000Z

Three sources on NetApp for 2 November. NetApp closed its PEAK:AIO acquisition to bring scale-out pNFS metadata into ONTAP for Novus AI-factory storage, but published no timeline, design or benchmarks. Independent HPC reporting finds PEAK:AIO's Lattice metadata server, built with Los Alamos and CMU, is an early release with vendor-only benchmarks and an unresolved ONTAP integration question. NetApp also issued an interim critical advisory for a Linux kernel remote-root flaw with no affected products listed yet. SLED relevance is limited mainly to research computing and security operations.

Three sources on NetApp for 2 November. NetApp closed its PEAK:AIO acquisition to bring scale-out pNFS metadata into ONTAP for Novus AI-factory storage, but published no timeline, design or benchmarks. Independent HPC reporting finds PEAK:AIO's Lattice metadata server, built with Los Alamos and CMU, is an early release with vendor-only benchmarks and an unresolved ONTAP integration question. NetApp also issued an interim critical advisory for a Linux kernel remote-root flaw with no affected products listed yet. SLED relevance is limited mainly to research computing and security operations. 3 sources · 1 cross-source patterns NetApp's parallel-metadata roadmap rests on claims not yet independently measured What workload-based evidence will a research computing center require before treating NetApp's parallel-metadata roadmap as a planning input?https://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-10-312026-11-02T01:21:21.449Z2026-10-31T00:00:00.000Z

NetApp's AI Data Engine reached general availability: release 1.3, dated October 26 and documented on October 30, is NetApp's first GA AIDE release. It ships metadata cataloging, cleanup of stale and duplicate data, retention actions, and MCP access for named AI clients scoped by Entra ID. Analysts in March had expected GA months earlier. AIDE's requirements show it needs an internet connection to AWS-hosted endpoints, NetApp Console sign-in, usage metrics sent to NetApp, and a link to the Console agent. NetApp's October 30 Brotli advisory lists Console Agent containers as affected or under investigation, with no fix. CISA has listed this flaw as actively exploited. For SLED, network egress approval and Console agent patching come before any AI benefit. No new SLED deployment evidence was found.

NetApp's AI Data Engine reached general availability: release 1.3, dated October 26 and documented on October 30, is NetApp's first GA AIDE release. It ships metadata cataloging, cleanup of stale and duplicate data, retention actions, and MCP access for named AI clients scoped by Entra ID. Analysts in March had expected GA months earlier. AIDE's requirements show it needs an internet connection to AWS-hosted endpoints, NetApp Console sign-in, usage metrics sent to NetApp, and a link to the Console agent. NetApp's October 30 Brotli advisory lists Console Agent containers as affected or under investigation, with no fix. CISA has listed this flaw as actively exploited. For SLED, network egress approval and Console agent patching come before any AI benefit. No new SLED deployment evidence was found. 3 sources · 1 cross-source patterns AIDE reaching GA puts the Console agent and cloud egress, not AI features, on the critical path for SLED pilots Can the security office approve AIDE's outbound endpoints and telemetry, and is every Console agent inventoried with compensating controls until NetApp lists a fixed build?https://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-10-302026-10-31T04:40:28.062Z2026-10-30T00:00:00.000Z

A quiet news day for NetApp AI: there has been no NetApp press release since October 2. The actionable signal is security operations. NetApp's critical PHP2SHELL advisory for ONTAP 9 now lists fixed releases on seven release lines and reports AI Data Engine as not affected. SUNY Geneseo upgraded its campus SAN to one of those releases in a 90-minute rolling window on October 29. A new October 30 MySQL advisory affects SnapCenter and puts AI Data Engine and Console Agent under investigation with no fixes yet. Arrow's managed Keystone service is a channel development with no SLED evidence.

A quiet news day for NetApp AI: there has been no NetApp press release since October 2. The actionable signal is security operations. NetApp's critical PHP2SHELL advisory for ONTAP 9 now lists fixed releases on seven release lines and reports AI Data Engine as not affected. SUNY Geneseo upgraded its campus SAN to one of those releases in a 90-minute rolling window on October 29. A new October 30 MySQL advisory affects SnapCenter and puts AI Data Engine and Console Agent under investigation with no fixes yet. Arrow's managed Keystone service is a channel development with no SLED evidence. 4 sources · 1 cross-source patterns Patch cadence across ONTAP and its surrounding data services is this week's actionable NetApp control for SLED Is every ONTAP cluster on a listed fixed release, and who is tracking the open status of SnapCenter, Console Agent and AIDE in NetApp's advisories?https://sled.lighthouseadvisory.consulting/streams/netapp/editions/2026-10-292026-10-30T03:21:40.721Z2026-10-29T00:00:00.000Z

First NetApp edition. NetApp's INSIGHT 2026 announcements extend AI Data Engine metadata discovery to non-NetApp storage and pitch Novus for AI factories. Its own documentation and trade reporting show the advanced AI features are still in preview and the headline throughput is modeled. In SLED, the concrete evidence is about operations, not AI: Los Angeles County is replacing end-of-life NetApp storage for ballot images and opened a NetApp consulting bid days before the November election, UC Berkeley EECS lost SMB share access for weeks during an Active Directory migration, and an October ONTAP 9 management-plane vulnerability calls for hotfixes. No independent SLED outcome evidence for NetApp AI products was found.

First NetApp edition. NetApp's INSIGHT 2026 announcements extend AI Data Engine metadata discovery to non-NetApp storage and pitch Novus for AI factories. Its own documentation and trade reporting show the advanced AI features are still in preview and the headline throughput is modeled. In SLED, the concrete evidence is about operations, not AI: Los Angeles County is replacing end-of-life NetApp storage for ballot images and opened a NetApp consulting bid days before the November election, UC Berkeley EECS lost SMB share access for weeks during an Active Directory migration, and an October ONTAP 9 management-plane vulnerability calls for hotfixes. No independent SLED outcome evidence for NetApp AI products was found. 6 sources · 2 cross-source patterns NetApp AI data announcements outpace what is generally available and documented today Which of the capabilities in this proposal are generally available and documented today, and what acceptance test will prove them on our data? Identity mappings and management-plane security, not AI features, are the near-term operating risks for NetApp estates in SLED Are our directory mappings, ONTAP patch levels and proxy architecture ready before we layer AI data services on this storage?