NetApp Products Vulnerabilities Affecting Data Integrity and Confidentiality

CERT-FR Security Advisories

Published March 27th, 2026

Detected March 27th, 2026

Summary

CERT-FR has issued an advisory regarding multiple vulnerabilities discovered in NetApp products, including Active IQ Unified Manager and ONTAP. These vulnerabilities could lead to data integrity and confidentiality breaches, as well as remote denial-of-service attacks. Affected users are advised to consult NetApp security bulletins for patch information.

View original document View source feed page

What changed

CERT-FR has released an advisory (CERTFR-2026-AVI-0363) detailing multiple critical vulnerabilities found in NetApp products, specifically affecting Active IQ Unified Manager for Windows (versions prior to 9.18) and NetApp ONTAP 9 (versions 9.17.x prior to 9.17.1 and versions prior to 9.16.1P12). The identified vulnerabilities, referenced by CVEs such as CVE-2024-9287, CVE-2025-1219, and CVE-2025-1736, pose significant risks including remote denial-of-service, data integrity compromise, and data confidentiality breaches.

Organizations utilizing the affected NetApp products must immediately consult the provided NetApp security bulletins (NTAP-20250425-0006, NTAP-20250523-0006, NTAP-20250523-0007) to obtain and apply the necessary patches. Failure to address these vulnerabilities could result in severe data loss, unauthorized access to sensitive information, and disruption of critical services, leading to significant operational and reputational damage.

What to do next

Consult NetApp security bulletins for affected product versions.
Apply available patches and updates to mitigate identified vulnerabilities.

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 27 mars 2026 N° CERTFR-2026-AVI-0363 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits NetApp

Gestion du document

Risques

Atteinte à l'intégrité des données
Atteinte à la confidentialité des données
Déni de service à distance

Systèmes affectés

Active IQ Unified Manager pour Microsoft Windows versions antérieures à 9.18
NetApp ONTAP 9 versions 9.17.x antérieures à 9.17.1
NetApp ONTAP 9 versions antérieures à 9.16.1P12

Résumé

De multiples vulnérabilités ont été découvertes dans les produits NetApp. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.