From the NetApp edition of November 2, 2026 and 5 later editions
NetApp advisory NTAP-20261102-0001 v10.0: newest StorageGRID appliance BMCs (SG6260/SGF6212/SG120/SG1200) now Affected with no fix; v9.0 swaps the AFF/ASA/FAS BMC fix links
NetApp Product Security · Storage infrastructure (cross-sector) · Global
- Publisher
- NetApp Product Security
- Original publication
- Initial release 2026-11-02; v9.0 and v10.0 both dated 2026-11-10
- Source retrieved
- 2026-11-11
- Event date
- 2026-11-10
What happened
NetApp revised its critical Linux kernel advisory (CVE-2026-98432, CVSS 3.1 9.8, remote unauthenticated root command execution, status Interim, NetApp aware of public discussion) twice on 10 Nov. v9.0 'Corrected fix links' for the two current AFF/ASA/FAS BMC families: the JSON now maps A1K/A90/A70/C80/FAS90/FAS70 to SP_FW_308-11102_18.7P2 and A50/A30/A20/C60/C30/FAS50 to SP_FW_308-11101_19.5P2, the reverse of the v8.0 mapping. v10.0 moves StorageGRID BMC SG6260/SGF6212/SG120/SG1200 (NetApp's newest StorageGRID appliance generation) to Affected Products, with no fix listed; SG6160/SGF6112/SG110/SG1100 BMCs remain Affected without a fix. Listed fixes are still only the two AFF/ASA/FAS BMC packages and E-Series SANtricity 11.90R7/12.10R1. ONTAP 9, AIDE and Trident remain Not Affected; A250/500f/C250 BMCs and SolidFire/HCI items remain Investigating.
Why it matters
StorageGRID is used by universities, research centers and state agencies as an S3 object store for archives, backups, FabricPool tiers and AI data lakes. Owners of the newest SG6260/SGF6212/SG120/SG1200 appliances, often recent purchases, now have an exposed out-of-band management controller with no fix. Teams that scheduled AFF BMC updates from the v8.0 mapping (including from this publication's 9 Nov edition) should re-check which package applies to which platform.
Evidence and measured results
Official vendor advisory. Version 10.0, last-updated date, status, CVSS and exploitation statement confirmed on the headless-rendered advisory page; revision history, affected/fix/investigating lists and fix links read from the official adv_api JSON behind the page. KB CSG-28196 (StorageGRID) states StorageGRID exposes no MPTCP ports but the full KB requires sign-in. No independent exploitation telemetry for NetApp products was found.
Limitations and uncertainty
Vendor-claim advisory; status Interim and lists may change again. The rendered page shows only the overview tab, so revision and fix details come from the JSON endpoint. Firmware package names are inferred from download file names. The swap is inferred by comparing the 10 Nov JSON with the 9 Nov JSON saved by the previous run; NetApp's revision note says only 'Corrected fix links'. SG6260/SGF6212/SG120/SG1200 being the newest generation is interpretation from NetApp's model numbering.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-11; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Customers with new StorageGRID appliances or current AFF/ASA/FAS systems may hold outdated remediation plans for a critical remote root vulnerability.
- Stakeholders
- Storage/object-storage administrators
- CISO or security office
- Research data or archive owners
- Change advisory board
- Discovery questions
- Which StorageGRID appliance models are deployed (SG6260/SGF6212/SG120/SG1200 or SG6160/SGF6112/SG110/SG1100)?
- Are appliance BMCs on an isolated management network?
- Were AFF/ASA/FAS BMC updates planned or applied using the v8.0 fix links?
- Who tracks advisory versions in your vulnerability program?
- Value hypothesis
- A short re-validation can prevent mis-applied firmware on current AFF systems and document compensating controls for unfixed StorageGRID BMCs.
- Potential engagement
- A bounded advisory re-mapping and BMC exposure review across AFF/ASA/FAS and StorageGRID appliances.
- Unsupported claims
- That StorageGRID appliances have a fix
- Any date for a StorageGRID BMC fix
- Exploitation against NetApp customers
- That ONTAP upgrades address this CVE
Pre-sales engineering
Role takeaway
- Fit
- Applies to customers with StorageGRID SG6260/SGF6212/SG120/SG1200 or SG6160/SGF6112/SG110/SG1100 appliances and current AFF/ASA/FAS A1K or A50-class systems.
- Architecture and integration
- BMC firmware is separate from ONTAP and StorageGRID software; mitigation for unfixed appliances is network isolation of BMC interfaces.
- Prerequisites
- Appliance and controller inventory by model
- Access to the v10.0 advisory JSON or Remediation tab
- Management-network topology
- NetApp Support download access
- Constraints
- No fix for StorageGRID appliance BMCs
- Fix-link mapping changed between v8.0 and v9.0
- KB CSG-28196 full content requires sign-in
- Security
- CVSS 9.8 remote unauthenticated root execution on BMCs; isolate and restrict source addresses until fixed; verify package-to-platform before flashing.
- Proof of value
- Confirm installed AFF BMC firmware matches the v9.0+ mapping
- Scan to verify StorageGRID BMC ports are unreachable from user networks
- Re-check advisory version before closing each change
Delivery
Role takeaway
- Work
- Re-validate queued AFF BMC firmware changes, add newest StorageGRID appliances to exceptions with compensating controls, and re-check on each advisory revision.
- Dependencies
- Customer change approvals
- Network team for BMC isolation
- NetApp Support account
- Ownership
- Customer storage operations owns firmware and appliance changes; security office owns exception acceptance.
- Skills and adoption
- Operators must handle BMC firmware for both AFF controllers and StorageGRID appliances, which follow different procedures from software upgrades.
- Governance checkpoints
- Re-approval of any change built on v8.0 links
- Exception sign-off for StorageGRID appliance BMCs
- Advisory-version check at closure
- Acceptance criteria
- 100% of planned AFF BMC updates re-validated against v9.0+ mapping
- Every affected StorageGRID appliance BMC has a documented compensating control
- BMC interfaces reachable only from approved admin subnets
- Risks
- Applying the wrong firmware package to a controller
- Further advisory changes after closure
- Flat management networks exposing BMCs
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
StorageGRID appliance BMCs are out-of-band controllers separate from StorageGRID software nodes; NetApp's note that StorageGRID exposes no MPTCP ports refers to the software, while the appliance BMCs are listed Affected separately. Mitigation until a fix ships is management-network isolation for every appliance BMC.
Governance
Who approves, reviews and stays accountable for outcomes?
Vulnerability records should track the advisory version used for decisions; a fix-link correction means change tickets created from v8.0 may reference the wrong firmware package.
Security and privacy
What data, permissions and controls need testing?
Critical remote root execution on management controllers of the newest StorageGRID appliances, with no fix; restrict BMC interfaces to isolated admin networks and verify firmware packages against platform before applying AFF BMC updates.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Adds out-of-band firmware and exception tracking to storage teams' patch load; no accessibility content.
Procurement
What should contracts, pricing and exit terms secure?
Recently purchased StorageGRID appliances are affected without a fix; buyers may raise remediation timelines in support discussions, but the advisory does not justify replacement.
Operating model
Which teams own the service once it runs?
Advisory revisions can change fix mappings; operations should tie each change ticket to a specific advisory version.
What changed
Archived at v8.0 (9 Nov), which mapped A1K/A90/A70/C80/FAS90/FAS70 to SP_FW_308-11101_19.5P2 and A50/A30/A20/C60/C30/FAS50 to SP_FW_308-11102_18.7P2. v9.0 (10 Nov) 'Corrected fix links', and the 10 Nov JSON now reverses that mapping, correcting what our 9 Nov edition reported. v10.0 (10 Nov) adds StorageGRID BMC SG6260/SGF6212/SG120/SG1200 to Affected Products with no fix. Not Affected status for ONTAP 9, AIDE and Trident re-verified.
Publication history
- 2026-11-10NetApp · Issue 122 resources
- 2026-11-09NetApp · Issue 113 resources
- 2026-11-07NetApp · Issue 092 resources
- 2026-11-06NetApp · Issue 083 resources
- 2026-11-03NetApp · Issue 053 resources
- 2026-11-02NetApp · Issue 043 resources
Stable resource ID: netapp-advisory-ntap-20261102-0001-linux-kernel-tcp-rce-interim-20261102