PT-2026-20299 · Microsoft+1 · Entra Id+2

Michele Damico · Published 2026-02-17 · Updated 2026-02-23 · CVE-2026-22048

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions StorageGRID versions prior to 11.9.0.12 StorageGRID versions prior to 12.0.0.4

Description StorageGRID, formerly known as StorageGRID Webscale, is affected by a Server-Side Request Forgery (SSRF) issue when Single Sign-on (SSO) is enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an Identity Provider (IdP). A successful exploit allows an authenticated attacker with low privileges to delete configuration data or deny access to resources.

Recommendations Update StorageGRID to version 11.9.0.12 or later. Update StorageGRID to version 12.0.0.4 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-22048

Affected Products

Azure Ad

Entra Id

Storagegrid

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-22048 · Security Note
• https://twitter.com/cracbot/status/2025888415804465637 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024018256365797443 · Twitter Post
• https://security.netapp.com/advisory/NTAP-20260217-0001 · Note
• https://twitter.com/offseq/status/2023955683129868661 · Twitter Post
• https://t.me/CVEtracker/44921 · Telegram Post
• https://twitter.com/CVEnew/status/2023901959648841966 · Twitter Post
• https://t.me/cveNotify/152260 · Telegram Post
• https://twitter.com/CVEarity/status/2024009279267893259 · Twitter Post