Lighthouse AdvisorySLED AI Adoption Intelligence

Strategic PartnersIssue 053 records

NetApp

Three NetApp security items for 3 November, all relevant to SLED storage operations rather than new AI deployments. NetApp disclosed two StorageGRID authentication-bypass flaws: a critical one (CVE-2026-22058) needing Grid Network access and a medium one (CVE-2026-22060) affecting all versions in default configurations. It also updated its interim Linux kernel advisory to say StorageGRID does not expose the affected MPTCP ports. Agencies and campuses using StorageGRID for backups, research or AI data should check Grid Network isolation and plan upgrades. No new SLED NetApp AI deployment evidence appeared.

Evidence records
3
Cross-source patterns
1
Evidence classes
3 vendor claim
Outcomes
3 cautionary
Source freshness
3 new this fortnight
Research completed
2026-11-04

Choose a role to see its takeaway beside every record in the ledger.

Patterns across the evidence

Synthesis · Lighthouse Advisory interpretation

1 pattern, each supported by at least two sources

  1. StorageGRID risk this week depends on Grid Network isolation

    Interpretation across two advisories. Both 3 November StorageGRID flaws involve requests reaching grid-internal interfaces, so SLED owners whose Grid Network is isolated from user and campus networks face lower practical risk while they schedule upgrades.

    Operating questionCan each SLED StorageGRID owner show that its Grid Network is unreachable from non-grid segments?

    Supporting evidenceNetApp advisory NTAP-20261103-0001: critical StorageGRID authentication bypass (CVE-2026-22058, CVSS 4.0 9.1)NetApp advisory NTAP-20261103-0002: StorageGRID unauthenticated access to internal grid APIs (CVE-2026-22060, CVSS 4.0 6.9)

Evidence ledger

Full record · every source keeps its link and limitations

3 records
  1. Vendor claimCautionaryPeer review status unknownNew this fortnight

    NetApp advisory NTAP-20261103-0001: critical StorageGRID authentication bypass (CVE-2026-22058, CVSS 4.0 9.1)

    NetApp published final advisory NTAP-20261103-0001 on 3 November for CVE-2026-22058 in StorageGRID, its object storage software. NetApp says versions 11.3 and later let an attacker with product-specific knowledge who can reach the Grid Network on certain ports make unauthorized requests, which could expose sensitive information or add or modify data. NetApp rates it critical (CVSS 4.0 score 9.1, high attack complexity) and says it is not aware of public discussion of the flaw.

    NetApp Product SecurityGlobal3 November 2026

    Why it matters, evidence and limitations
    Why it matters
    Relevant to state agencies, universities, research centers and K-12 districts using StorageGRID for backups, archives, research data or AI training data lakes. The attack needs access to the Grid Network, so exposure depends mostly on how well that network is isolated.
    Evidence and measured results
    Opened the rendered advisory page and read summary, impact, scoring and exploitation sections. This is a vendor self-disclosure; no independent analysis was found.
    Limitations and uncertainty
    Vendor-reported; rendered page did not show affected-version fix details beyond the summary; no exploitation reported.
    NetApp, Security Advisory NTAP-20261103-0001, 3 November 2026 Role takeaways & implementation
  2. Vendor claimCautionaryPeer review status unknownNew this fortnight

    NetApp advisory NTAP-20261103-0002: StorageGRID unauthenticated access to internal grid APIs (CVE-2026-22060, CVSS 4.0 6.9)

    NetApp published final advisory NTAP-20261103-0002 on 3 November for CVE-2026-22060. NetApp says all StorageGRID versions in default and common configurations let an unauthenticated attacker reach a limited set of APIs meant for use inside the grid, which could expose sensitive information or add or modify data. NetApp rates it medium (CVSS 4.0 score 6.9) and says it is not aware of public discussion.

    NetApp Product SecurityGlobal3 November 2026

    Why it matters, evidence and limitations
    Why it matters
    Applies to every SLED StorageGRID deployment regardless of version, because NetApp says default configurations are affected. Agencies and campuses storing research, backup or AI pipeline data in StorageGRID should check exposure even though severity is medium.
    Evidence and measured results
    Opened the rendered advisory page and read all sections. Vendor self-disclosure; no independent analysis found.
    Limitations and uncertainty
    Vendor-reported; medium severity; no exploitation reported; fix details not shown in rendered summary.
    NetApp, Security Advisory NTAP-20261103-0002, 3 November 2026 Role takeaways & implementation
  3. Vendor claimCautionaryPeer review status unknownNew this fortnight

    NetApp updates NTAP-20261102-0001 to v4.0: StorageGRID does not expose MPTCP ports for critical Linux kernel flaw CVE-2026-98432

    NetApp updated interim advisory NTAP-20261102-0001 to version 4.0 on 3 November. The advisory covers CVE-2026-98432, a critical (CVSS 3.1 9.8) Linux kernel flaw that could allow remote unauthenticated root command execution. The new version adds that StorageGRID does not expose any Multipath TCP (MPTCP) ports. The advisory is still interim, NetApp is aware of public discussion, and other NetApp products are not yet mapped in the rendered page.

    NetApp Product SecurityGlobalAdvisory v4.0, last updated 3 November 2026

    Why it matters, evidence and limitations
    Why it matters
    Gives SLED StorageGRID owners a partial answer on exposure to the kernel flaw covered on 2 November, but ONTAP, appliance and management-software owners still lack a product list and should keep watching the advisory.
    Evidence and measured results
    Opened the rendered v4.0 page and compared it with the v2.0 content archived on 2 November. Vendor self-disclosure.
    Limitations and uncertainty
    Interim; StorageGRID statement is vendor-asserted; other products unmapped.
    NetApp, Security Advisory NTAP-20261102-0001, Advisory v4.0, last updated 3 November 2026 Role takeaways & implementation

How to read this edition

Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.

Vendor claim
A supplier-provided assertion that has not been upgraded to independent evidence.