Lighthouse AdvisorySLED AI Adoption Intelligence

Strategic PartnersIssue 092 records

NetApp

Thin vendor-sourced NetApp signal for 7 November; no new independent SLED deployment evidence. NetApp revised critical Linux kernel advisory NTAP-20261102-0001 (CVE-2026-98432, CVSS 9.8) to v7.0. It lists the advisory's first fixes, E-Series SANtricity OS 11.90R7 and 12.10R1, while other Affected products such as BMCs, ONTAP Select Deploy, CVO Mediator and StorageGRID remain unfixed, and ONTAP 9 and AIDE stay Not Affected. Separately, NetApp's ONTAP 9.20.1 release notes for AFX (dated 5 November, not previously covered) describe full enterprise feature support at 32 nodes, FabricPool tiering, directories of about 25 million files for AI training, and lower default ARP/AI periodic snapshot retention after upgrade. NetApp provides no benchmark for these changes.

Evidence records
2
Cross-source patterns
0
Evidence classes
2 vendor claim
Outcomes
1 cautionary1 emerging
Source freshness
2 new this fortnight
Research completed
2026-11-08

Choose a role to see its takeaway beside every record in the ledger.

Patterns across the evidence

Synthesis · Lighthouse Advisory interpretation

No pattern claimed

The evidence in this edition did not support a cross-source pattern. Each record below stands on its own.

Evidence ledger

Full record · every source keeps its link and limitations

2 records
  1. Vendor claimCautionaryPeer review status unknownNew this fortnight

    NetApp advisory NTAP-20261102-0001 v7.0: first fixes published (E-Series SANtricity OS 11.90R7 and 12.10R1) for critical CVE-2026-98432

    On 7 November 2026 NetApp revised NTAP-20261102-0001 to v7.0, adding E-Series SANtricity OS Controller Software 11.90R7 and 12.10R1 to Software Versions and Fixes for CVE-2026-98432, a critical (CVSS 3.1 score 9.8) Linux kernel flaw that could allow remote unauthenticated attackers to execute commands with root privileges. These are the first fix versions listed on the advisory; it remains Interim and every other Affected product (AFF/FAS BMCs and service processors, ONTAP Select Deploy, ONTAP tools for VMware vSphere 10, Cloud Volumes ONTAP Mediator, StorageGRID and the StorageGRID SG6160/SGF6112/SG110/SG1100 BMC) still has no listed fix. ONTAP 9 and AI Data Engine (AIDE) remain Not Affected; eight products, including the SG6260/SGF6212/SG120/SG1200 BMC and SolidFire/HCI nodes, remain Under Investigation.

    NetApp Product SecurityGlobalAdvisory v7.0, last updated 7 November 2026 (originally published 2 November 2026)

    Why it matters, evidence and limitations
    Why it matters
    Relevant to SLED research computing and HPC/AI storage estates that run NetApp E-Series (for example as block storage behind parallel file systems), which now have a vendor-listed remediation path. Other Affected NetApp management components in state, local and higher-education estates still have no fix, so the update narrows but does not close exposure. ONTAP 9 controllers and AIDE remain Not Affected.
    Evidence and measured results
    Opened the rendered advisory page via WebFetch (shows v7.0, last updated 11/07/2026, Interim, CVSS 9.8 critical, summary and impact) and the official adv_api JSON; diffed the JSON against the copy saved during the 6 November run: only fixes, revision history and update dates changed. Revision history v7.0 dated 20261107 reads 'E-Series SANtricity OS Controller Software 11.90R7 and 12.10R1 added to Software Versions and Fixes'. Vendor self-disclosure; no independent confirmation.
    Limitations and uncertainty
    Vendor self-disclosure; Interim status; fix links point to the NetApp support site (login required, not opened). The HTML advisory is an SPA shell, so fix and product tables come from the official adv_api JSON. Which E-Series releases are vulnerable versus fixed beyond the two listed versions is not stated. Repeat of an archived advisory, justified by the first published fixes.
    NetApp, Security Advisory NTAP-20261102-0001, v7.0, 7 November 2026 Role takeaways & implementation
  2. Vendor claimEmergingPeer review status unknownNew this fortnight

    NetApp documents ONTAP 9.20.1 for AFX: full 32-node enterprise support, FabricPool, AI-scale directories and changed ARP/AI snapshot defaults

    NetApp's ONTAP 9.20.1 release notes for AFX, its disaggregated storage line aimed at AI/ML, say AFX clusters can now be deployed at full 32-node scale with complete enterprise feature support. NetApp says it validated NFS, SMB, S3, FlexGroup and FlexCache plus HA and recovery workflows at that scale. The notes also extend FabricPool tiering to AFX (also in 9.19.1 P3) and qualify directories up to 4GB (about 25 million files) for workloads such as AI training. Other additions are FPolicy monitoring for NFS 4.2 and S3, IdP/AD/LDAP groups as multi-admin verification approvers, and SNMPv3 SHA-512. The notes also change the Autonomous Ransomware Protection (ARP/AI) snapshot defaults after upgrade: maximum periodic snapshots drop from 6 to 2 and retention from 12 to 7 hours, unless those options were modified earlier.

    NetAppGlobalDocumentation page dated 11/05/2026

    Why it matters, evidence and limitations
    Why it matters
    Applies to universities, research institutions and state agencies evaluating AFX for AI/ML pipelines or large unstructured-data estates: 32-node enterprise support, FabricPool tiering and large-directory qualification address scale and cost questions. The ARP/AI snapshot default change matters to any public-sector ransomware recovery plan built on ARP periodic snapshots. These are vendor statements. No SLED deployment or measured result is reported.
    Evidence and measured results
    Opened the AFX 9.20.1 what's-new page via WebFetch and curl. Read every section (data protection, NAS, networking, S3, SAN, security, efficiency, resource management, System Manager). Cross-checked two other NetApp docs: the ONTAP upgrade-duration guide says the upgrade to 9.20.1 with an external KMIP key manager takes longer than one hour per HA pair, and the AFX technical report still lists ONTAP 9.19.1GA (August 2026) as the latest release and already lists 32-node support. No benchmark, customer or performance figures are given for the 9.20.1 features.
    Limitations and uncertainty
    Vendor documentation only; no independent benchmark, customer deployment or measured outcome. The page is dated 11/05/2026, before the last completed run, but it is not in the archive, the 5 and 6 November runs missed it, and the AFX full-documentation PDF was regenerated on 6 November. Documentation is inconsistent: the AFX technical report still names 9.19.1 as latest and already lists 32-node support, so the 9.20.1 change appears to be full enterprise-feature parity at 32 nodes rather than first 32-node support. GA versus RC status of 9.20.1 is not stated on the page.
    NetApp, What's new in ONTAP 9.20.1 for AFX storage systems, 5 November 2026 Role takeaways & implementation

How to read this edition

Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.

Vendor claim
A supplier-provided assertion that has not been upgraded to independent evidence.