CVE-2026-22063

MediumCVSS 6.0/10Last modified Nov 4, 2026

Description

The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.

Metrics

CVSS 4.0 6.0/10

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
NetApp	ONTAP 9	< 9.18.1
NetApp	StorageGRID (formerly StorageGRID Webscale)	<= 12.2.0
NetApp	E-Series SANtricity OS Controller Software	0

References

https://security.netapp.com/advisory/NTAP-20261027-0001/

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-220685.3Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10 CVE-2026-22075.3A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js CVE-2026-220709.8ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.CVE-2026-220728.3Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.CVE-2026-220775.6OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may CVE-2026-220787.3Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions CVE-2026-220798.7This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmissio CVE-2026-22086.5A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of CVE-2026-220808.7This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of crede CVE-2026-220818.8This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag CVE-2026-220828.8This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credenti CVE-2026-22094.3A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/se