NetApp

Vendor-claim advisory; status Interim and lists may change again. The rendered page shows only the overview tab, so revision and fix details come from the JSON endpoint. Firmware package names are inferred from download file names. The swap is inferred by comparing the 10 Nov JSON with the 9 Nov JSON saved by the previous run; NetApp's revision note says only 'Corrected fix links'. SG6260/SGF6212/SG120/SG1200 being the newest generation is interpretation from NetApp's model numbering.

Vendor-claim. 'Fastest storage on the planet' and 100 TB/s are NetApp design claims without disclosed test conditions. Release includes a forward-looking disclaimer. European sovereignty framing (EU jurisdiction, CLOUD Act concerns on Nebul's government page) does not map directly to U.S. state requirements such as CJIS or FedRAMP-equivalent state programs. Cross-stream note: DDN and NVIDIA appear only as context.

Vendor-claim only (AWS). The four new Regions are unnamed in the announcement; the GovCloud status is inferred from an unmarked cell in the user-guide table on retrieval date and may change. Cross-stream: this is an AWS-delivered NetApp ONTAP service; filed under NetApp because it changes how ONTAP-resident data reaches AI services. No performance or cost figures were published.

Vendor-claim advisory, Interim status. Severity is Medium and exploitation requires high attack complexity and user interaction per the CVSS vector. AIDE status unresolved. Prevalence of pre-9.18.1 ONTAP in SLED is interpretation, not measured.

Trade-press recap dominated by vendor quotes; no benchmarks, customers, pricing, integration timeline or SLED data; ARP/AI efficacy is not evaluated.

Interim; no workaround or fix; Investigating products may still move to Not Affected; ONTAP 9 Not Affected does not clear Select Deploy; product tables from adv_api.

Interim; no workaround or fix versions; FreeBSD 15.1 to specific ONTAP 9 release mapping not stated; product tables from adv_api because the HTML SPA omits them; vendor self-assessment.

Interim; Affected list empty; Investigating products may still be cleared; no workaround or fix published; product lists from NetApp adv_api (HTML page omitted tables); AIDE Not Affected does not prove every Console Agent container is safe.

Interim; Affected list empty; Investigating products may still be cleared; no workaround or fix published; product lists taken from NetApp adv_api (HTML page did not render the tables).

Vendor documentation only; no independent benchmark, customer deployment or measured outcome. The page is dated 11/05/2026, before the last completed run, but it is not in the archive, the 5 and 6 November runs missed it, and the AFX full-documentation PDF was regenerated on 6 November. Documentation is inconsistent: the AFX technical report still names 9.19.1 as latest and already lists 32-node support, so the 9.20.1 change appears to be full enterprise-feature parity at 32 nodes rather than first 32-node support. GA versus RC status of 9.20.1 is not stated on the page.

Interim; affected NetApp products and fixes not shown on the rendered page; high attack complexity; no exploitation reported by NetApp.

Vendor-reported; rendered page did not show affected-version fix details beyond the summary; no exploitation reported.

Vendor-reported; medium severity; no exploitation reported; fix details not shown in rendered summary.

No pricing, timeline, benchmark or integration design. The deal closed on the edition date, so customer impact is speculative.

KB text retrieved was partial; full advisory not inspected; severity and exploitation status not confirmed from the original advisory.

Vendor-authored and Interim; the advisory went through eight versions in a week. NetApp gives no NetApp-specific exploitation evidence. CISA and CCCS describe Brotli generally. The page is JavaScript-rendered. First-time source, not in the archive. The 10-30 edition covered the separate PHP2SHELL and MySQL advisories.

Interim version 1.0 published the same day as retrieval; product status may change. Which CVEs apply to which NetApp product is not broken out. The page is JavaScript-rendered and was read in a headless browser.

Vendor-authored. GA status does not establish production scale, accuracy or cost outcomes. The 1.3 feature list is narrower than the 2025 announcement, and this run did not confirm whether the missing features are deferred or dropped. Known limitations were covered in our 2026-10-29 edition. This GA notice is a first-time source; it was updated 10/30 and is not in the archive.

Vendor press release with no outcomes or public-sector specifics. Opened via the Nasdaq copy because the Business Wire original returned HTTP 403.

Vendor-authored and still Interim; the content may change. The impact limits are NetApp's claim. The page is JavaScript-rendered; remediation and revision tabs were read in a headless browser. Our prior edition covered the companion KB article; this is the advisory itself, opened for the first time.

Vendor-authored; limitations may change between releases. Page states it may not apply to every product version.

Vendor documentation that may change. Absence of an offline procedure in the pages opened is not proof that none exists. Telemetry content and retention are not described here. First-time source, not in the archive; included now because GA (26 October) makes these requirements the evaluation gate.

Single operator status notice; it gives no reason for the upgrade, no confirmation of zero user impact beyond "completed", and no cluster size. The link to the PHP advisory is our interpretation, based on the matching release number.

Vendor-sourced figures relayed by trade press; projection not measurement; scale far exceeds most SLED environments.

Analyst opinion; predates the deal close; Futurum discloses vendor relationships; no measured results.

Single trade-press report; the test scale and workload behind Omdia's projection are not given; the figure is a projection of sequential reads, not a deployed or mixed-workload result; predates the acquisition close.

Transferability: vendor announcement for enterprise buyers; no SLED customer, deployment or measured outcome is cited. Advanced AIDE features are preview with no GA date stated; recovery-speed claims are unverified.

Predates the edition window; written before close. Benchmarks are vendor- and lab-reported, some without baselines. SCN's ONTAP conflict reading is its own interpretation.

Single departmental incident; cause not specified and not attributed to NetApp product defects.

Expected benefits only; consulting scope unknown; no link to AI use stated.