CVE-2026-22049CWE-288

CVE-2026-22049

High · published July 22, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00531 · 44.0th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-07-22T23:16Z
Affected products (1)
ProductVersionsFixed in
netapp/ontap≥ 9.16.1, < 9.19.19.19.1
References (1)
https://security.netapp.com/advisory/NTAP-20260722-0001/ · [email protected]
EPSS history
Timeline
  • 22 JUL 18:52Z
    ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID…
    cvelistv5