PT-2026-63447 · Netapp · Ontap 9

CVE-2026-22049 · Published 2026-07-22 · Updated 2026-07-22

NVD

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-22049

Affected Products

Ontap 9

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-22049 · Security Note
• https://security.netapp.com/advisory/NTAP-20260722-0001 · Note