Lighthouse AdvisorySLED AI Adoption Intelligence

Strategic PartnersIssue 083 records

NetApp

Three NetApp Product Security signals on 6 November. New interim NTAP-20261106-0012 lists ONTAP 9 Affected for FreeBSD CVE-2026-101307 (CVSS 4.0 HIGH 8.2 remote kernel panic) with no workaround or fix, while AIDE and StorageGRID are Not Affected. New interim NTAP-20261106-0001 lists ONTAP Select Deploy Affected for Linux kernel CVE-2026-72493 (CVSS 3.1 CRITICAL 9.9) and keeps Console Agent OVA, SolidFire/HCI and SnapCenter VMware plugin under Investigating, with ONTAP 9 Not Affected. Archived NTAP-20261102-0001 revised to v6.0 moves Cloud Volumes ONTAP Mediator and StorageGRID BMC SG6160/SGF6112/SG110/SG1100 to Affected (SG6060 BMC line Not Affected) for critical CVE-2026-98432, while still stating StorageGRID exposes no MPTCP ports.

Evidence records
3
Cross-source patterns
1
Evidence classes
3 vendor claim
Outcomes
3 cautionary
Source freshness
3 new this fortnight
Research completed
2026-11-07

Choose a role to see its takeaway beside every record in the ledger.

Patterns across the evidence

Synthesis · Lighthouse Advisory interpretation

1 pattern, each supported by at least two sources

  1. 6 November NetApp advisories list core products Affected without fixes

    Interpretation across two new official advisories published 6 November. NTAP-20261106-0012 lists ONTAP 9 Affected for a HIGH FreeBSD DoS issue, and NTAP-20261106-0001 lists ONTAP Select Deploy Affected for a CRITICAL Linux kernel issue; both remain Interim with empty fixes and no workarounds. SLED owners should inventory those Affected products now and isolate management planes rather than waiting for a fixes table.

    Operating questionWhich ONTAP 9 clusters and ONTAP Select Deploy instances do we run, and can non-admin networks reach their management planes?

    Supporting evidenceNetApp advisory NTAP-20261106-0012: FreeBSD CVE-2026-101307 HIGH 8.2; ONTAP 9 Affected, no fix yetNetApp advisory NTAP-20261106-0001: critical Linux kernel CVE-2026-72493; ONTAP Select Deploy Affected

Evidence ledger

Full record · every source keeps its link and limitations

3 records
  1. Vendor claimCautionaryPeer review status unknownNew this fortnight

    NetApp advisory NTAP-20261106-0012: FreeBSD CVE-2026-101307 HIGH 8.2; ONTAP 9 Affected, no fix yet

    On 6 November 2026 NetApp published interim NTAP-20261106-0012 v1.0 for CVE-2026-101307: FreeBSD 15.1 can allow a remote attacker to trigger an out-of-bounds write in the kernel heap resulting in a kernel panic. CVSS 4.0 scores it HIGH 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). The official advisory API lists ONTAP 9 under Affected Products and an empty Investigating list. AI Data Engine (AIDE), StorageGRID, SnapCenter, ONTAP Select Deploy and Cloud Volumes ONTAP Mediator appear on Not Affected. Status Interim; exploitation discussion Public; workarounds none at this time; fixes list empty.

    NetApp Product SecurityGlobalAdvisory v1.0, last updated 6 November 2026

    Why it matters, evidence and limitations
    Why it matters
    Directly relevant to SLED agencies and campuses whose primary NetApp estate is ONTAP 9—the product NetApp lists as Affected—while AIDE AI-metadata stacks and StorageGRID object estates are listed Not Affected. Owners should treat this as a controller/DoS patch-readiness issue, not as confirmation that every ONTAP 9 release string is equally exposed (NetApp does not publish per-release mapping here).
    Evidence and measured results
    Opened the rendered advisory page via WebFetch and the official adv_api JSON for NTAP-20261106-0012; read summary, impact, scoring, Affected/Not Affected lists and revision history. Vendor self-disclosure; FreeBSD-SA-26:70.tcp referenced.
    Limitations and uncertainty
    Interim; no workaround or fix versions; FreeBSD 15.1 to specific ONTAP 9 release mapping not stated; product tables from adv_api because the HTML SPA omits them; vendor self-assessment.
    NetApp, Security Advisory NTAP-20261106-0012, v1.0, 6 November 2026 Role takeaways & implementation
  2. Vendor claimCautionaryPeer review status unknownNew this fortnight

    NetApp advisory NTAP-20261106-0001: critical Linux kernel CVE-2026-72493; ONTAP Select Deploy Affected

    On 6 November 2026 NetApp published interim NTAP-20261106-0001 v1.0 for CVE-2026-72493, a Linux kernel slab use-after-free in older 3.x kernel ranges. CVSS 3.1 scores it CRITICAL 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected Products lists ONTAP Select Deploy administration utility. Investigating includes Brocade Fabric Operating System Firmware, NetApp Console Agent OVA, SolidFire & HCI management and storage nodes, and SnapCenter Plug-in for VMware vSphere. ONTAP 9, StorageGRID and SnapCenter (non-plugin) appear Not Affected. Status Interim; exploitation Public; workarounds none; fixes empty.

    NetApp Product SecurityGlobalAdvisory v1.0, last updated 6 November 2026

    Why it matters, evidence and limitations
    Why it matters
    Relevant to SLED virtualization estates that use ONTAP Select Deploy to stand up software-defined ONTAP, and to operators still running Investigating Console Agent OVA, SolidFire/HCI or SnapCenter VMware plugin components. Core ONTAP 9 hardware arrays are listed Not Affected, so risk concentrates on Select Deploy and adjacent management/HCI tooling rather than primary AFF controllers.
    Evidence and measured results
    Opened the rendered advisory page via WebFetch and the official adv_api JSON for NTAP-20261106-0001; read summary, impact, scoring, Affected/Investigating/Not Affected lists and revision history. Vendor self-disclosure; kernel.org stable commits referenced.
    Limitations and uncertainty
    Interim; no workaround or fix; Investigating products may still move to Not Affected; ONTAP 9 Not Affected does not clear Select Deploy; product tables from adv_api.
    NetApp, Security Advisory NTAP-20261106-0001, v1.0, 6 November 2026 Role takeaways & implementation
  3. Vendor claimCautionaryPeer review status unknownNew this fortnight

    NetApp advisory NTAP-20261102-0001 v6.0: CVO Mediator and StorageGRID BMC SG6160 line moved to Affected for critical CVE-2026-98432

    On 6 November 2026 NetApp revised NTAP-20261102-0001 to v6.0 for CVE-2026-98432, a critical (CVSS 3.1 score 9.8) Linux kernel flaw that could allow remote unauthenticated root command execution. The v6.0 revision moved Cloud Volumes ONTAP Mediator and StorageGRID Baseboard Management Controller (BMC) SG6160/SGF6112/SG110/SG1100 to Affected Products, and moved StorageGRID BMC SG6060/SGF6024/SG100/SG1000 to Products Not Affected. The Affected list also continues to include numerous AFF/FAS BMCs and service processors, ONTAP Select Deploy, ONTAP tools for VMware vSphere 10, StorageGRID (formerly StorageGRID Webscale) and E-Series SANtricity OS Controller Software. Impact text still states StorageGRID does not expose any Multipath TCP (MPTCP) ports. ONTAP 9 and AIDE remain Not Affected. Status Interim; workarounds none; fixes empty.

    NetApp Product SecurityGlobalAdvisory v6.0, last updated 6 November 2026

    Why it matters, evidence and limitations
    Why it matters
    Material for SLED operators running Cloud Volumes ONTAP Mediator or StorageGRID appliances with SG6160/SGF6112/SG110/SG1100 BMCs newly listed Affected, and for estates with AFF/FAS BMCs already in the Affected set. ONTAP 9 data controllers and AIDE remain Not Affected. Operators must reconcile StorageGRID’s Affected disposition with NetApp’s statement that StorageGRID exposes no MPTCP ports.
    Evidence and measured results
    Opened the rendered advisory page via WebFetch and the official adv_api JSON for NTAP-20261102-0001; read summary, impact (including StorageGRID MPTCP note), scoring, Affected/Investigating/Not Affected lists and revision history through v6.0. Vendor self-disclosure.
    Limitations and uncertainty
    Interim; no workaround or fix; StorageGRID listed Affected while impact says no MPTCP ports exposed—exposure path may be BMC/other, not MPTCP on StorageGRID services; product tables from adv_api; update of previously archived advisory.
    NetApp, Security Advisory NTAP-20261102-0001, v6.0, 6 November 2026 Role takeaways & implementation

How to read this edition

Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.

Vendor claim
A supplier-provided assertion that has not been upgraded to independent evidence.