Strategic PartnersIssue 113 records
NetApp
Three vendor-sourced NetApp signals for 9 November; no new independent SLED deployment evidence. AWS extended S3 Access Points for FSx for NetApp ONTAP to four more Regions, letting AI services such as Bedrock Knowledge Bases read ONTAP file data in place. The AWS user guide does not mark GovCloud as supported and lists unsupported S3 features such as Object Lock and versioning. NetApp's critical kernel advisory NTAP-20261102-0001 v8.0 adds the first BMC firmware fixes for current A1K/A90/A70 and A50/A30/A20 families, while older BMCs, Select Deploy and StorageGRID remain unfixed. The eMudhra CA compromise advisory (v9.0) keeps ONTAP 9 below 9.18.1, StorageGRID and Trident Affected with workarounds, and AIDE still under investigation.
- Evidence records
- 3
- Cross-source patterns
- 1
- Evidence classes
- 3 vendor claim
- Outcomes
- 2 cautionary1 emerging
- Source freshness
- 3 new this fortnight
- Research completed
- 2026-11-10
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
9 Nov advisory revisions add hardware/E-Series fixes while software exposure stays on workarounds
Both 9 Nov revisions add fixes for firmware or E-Series (current-generation BMCs on the critical kernel advisory; SANtricity and the e-series Console Agent on the eMudhra advisory) while other affected components remain without a listed fix: older BMC/SP families, Select Deploy, StorageGRID on the kernel advisory, and ONTAP 9, StorageGRID and Trident (workaround only) on the eMudhra advisory. AIDE is Not Affected on one and still Investigating on the other. Interpretation: SLED owners need per-product, per-version tracking rather than a single 'NetApp patched' status.
Operating questionDoes our vulnerability tracker record NetApp advisory status by product family and advisory version, with compensating controls for affected items still lacking a fix?
Supporting evidenceNetApp advisory NTAP-20261102-0001 v8.0: BMC firmware fixes published for current AFF/ASA/FAS A1K-A90-A70 and A50-A30-A20 families on critical CVE-2026-98432NetApp advisory NTAP-20261027-0001 v9.0: eMudhra CA compromise leaves ONTAP 9, StorageGRID and Trident Affected with workarounds; AIDE still Investigating
Evidence ledger
Full record · every source keeps its link and limitations
AWS extends S3 Access Points for FSx for NetApp ONTAP to four more Regions; AWS GovCloud (US) still not listed as supported
AWS says S3 Access Points can now attach to FSx for NetApp ONTAP file systems in 4 additional Regions, letting S3-based AI/ML and analytics services (its example: Bedrock Knowledge Bases, Athena, Glue) read file data in place without copying. The announcement does not name the four Regions. The FSx for ONTAP user guide's Region table, inspected the same night, marks US East/West commercial Regions and most international Regions supported but leaves AWS GovCloud (US-East) and (US-West) and Asia Pacific (Thailand) unmarked. Why now: posted 9 Nov, after the last NetApp run; not in archive.
Why it matters, evidence and limitations
- Why it matters
- Agencies and universities already running FSx for ONTAP (file shares, research data) could expose that data to retrieval-augmented generation pipelines without a second copy, reducing duplicate-data governance. Applicability is limited for workloads that must stay in AWS GovCloud (for example CJIS-scoped public-safety data or some state HHS systems), because the user guide does not mark GovCloud as supported. No SLED deployment is reported.
- Evidence and measured results
- Vendor documentation only. The announcement states the regional expansion and use cases. The user guide states dual authorization (IAM access-point policy plus an associated UNIX/Windows file-system user), enforced Block Public Access that cannot be disabled, latency 'in the tens of milliseconds range', and throughput bounded by the file system's provisioned throughput. The compatibility page lists unsupported S3 features (object versioning, Object Lock, lifecycle, ACLs other than bucket-owner-full-control, MFA, conditional writes) and a 50 GiB upload limit. No benchmark, customer measurement or independent evaluation was found.
- Limitations and uncertainty
- Vendor-claim only (AWS). The four new Regions are unnamed in the announcement; the GovCloud status is inferred from an unmarked cell in the user-guide table on retrieval date and may change. Cross-stream: this is an AWS-delivered NetApp ONTAP service; filed under NetApp because it changes how ONTAP-resident data reaches AI services. No performance or cost figures were published.
NetApp advisory NTAP-20261102-0001 v8.0: BMC firmware fixes published for current AFF/ASA/FAS A1K-A90-A70 and A50-A30-A20 families on critical CVE-2026-98432
Version 8.0 (last updated 11/09/2026) of NetApp's critical Linux kernel advisory (CVE-2026-98432, CVSS 3.1 9.8, remote unauthenticated root command execution, status Interim) adds Software Versions and Fixes for two current controller families' BMCs: AFF/ASA/FAS A1K/A90/A70/C80/FAS90/FAS70 (firmware package SP_FW_308-11101_19.5P2) and A50/A30/A20/C60/C30/FAS50 (SP_FW_308-11102_18.7P2). E-Series SANtricity OS 11.90R7/12.10R1 remain the other listed fixes. Affected products without a listed fix still include older BMC/SP families (A700s, 8300/8700/A400/C400, A320, A800/C800, A900/9500, C190/A150/A220/FAS2720/FAS2750, FAS2820, A300/8200, A700/9000), Cloud Volumes ONTAP Mediator, ONTAP Select Deploy, ONTAP tools for VMware vSphere 10, StorageGRID and StorageGRID BMC SG6160/SGF6112/SG110/SG1100. ONTAP 9, AIDE and Trident remain Not Affected.
Why it matters, evidence and limitations
- Why it matters
- The A90/A70/A1K and A50/A30/A20 families are NetApp's current AFF/ASA platforms that SLED buyers are procuring for AI and general storage; their out-of-band BMCs now have a fix path, so patch windows can be scheduled. Owners of older arrays still in service at counties, universities and school districts remain without a listed fix and must rely on BMC network isolation.
- Evidence and measured results
- Official vendor advisory. Product lists, fix links and revision history taken from the official adv_api JSON endpoint behind the advisory SPA; version, date, summary and CVSS confirmed on the headless-rendered advisory page. No independent exploitation telemetry for NetApp products was found; NetApp states it is aware of public discussion.
- Limitations and uncertainty
- Vendor-claim advisory; status remains Interim and lists may change. Fix firmware version strings are inferred from NetApp Support download file names in the JSON, not from release notes. Hardware-to-AI-deployment linkage is interpretation.
NetApp advisory NTAP-20261027-0001 v9.0: eMudhra CA compromise leaves ONTAP 9, StorageGRID and Trident Affected with workarounds; AIDE still Investigating
NetApp's advisory for CVE-2026-22063 (CVSS 4.0 6.0 Medium, status Interim) states eight eMudhra intermediate CA private keys were compromised and revoked on 18 October 2026, enabling man-in-the-middle attacks. v9.0 (9 Nov) adds fixes for E-Series SANtricity OS (11.90R1, 12.10R1) and the e-series Console Agent container. ONTAP 9 is Affected: the 'AAA Certificate Services' root was preinstalled before 9.18.1, and the workaround is deleting it with 'security certificate delete' at advanced privilege. StorageGRID (KB CSG-28116), Trident, Trident Autosupport, Data Infrastructure Insights agents and others are also Affected. AI Data Engine (AIDE) remains under Investigating; AIDE MCP Server and Langchain Retriever are Not Affected. Why now: first coverage; the 9 Nov revision adds fixes, and ONTAP 9 remains unfixed.
Why it matters, evidence and limitations
- Why it matters
- SLED NetApp estates commonly run ONTAP releases older than 9.18.1, so the preinstalled trust anchor is likely present on many arrays serving agency, campus and district data, including those feeding AI pipelines. Trident is also Affected, which matters for Kubernetes-based research and AI platforms.
- Evidence and measured results
- Official vendor advisory. Summary, impact, CVSS and version/date confirmed on the headless-rendered page; affected, investigating and fix lists from the official adv_api JSON. NetApp cites eMudhra's statement and a CERT-In note; those references were not opened. No independent evidence of exploitation against NetApp products was found.
- Limitations and uncertainty
- Vendor-claim advisory, Interim status. Severity is Medium and exploitation requires high attack complexity and user interaction per the CVSS vector. AIDE status unresolved. Prevalence of pre-9.18.1 ONTAP in SLED is interpretation, not measured.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.