CVE-2025-26516

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated attacker to cause a Denial of Service on the Admin node.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-405

Affected software

Vendor	Product	Versions
NetApp	StorageGRID	< 11.8.0.15; < 11.9.0.8

References

https://security.netapp.com/advisory/NTAP-20250910-0003Vendor Advisory

Timeline

Published: Sep 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-265175.4StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerabili CVE-2025-265197.0musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrus CVE-2025-26527.5A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected b CVE-2025-265209.8Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue CVE-2025-265218.1When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin CVE-2025-265227.5This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. CVE-2025-265237.4This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition CVE-2025-265245.1This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticat CVE-2025-265258.6Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as tho CVE-2025-265266.5Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback ac CVE-2025-265275.3Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.CVE-2025-265286.1The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.