CVE Explorer
CVE-2026-22049
ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1
Preserved source conflicts
No provider value was silently selected as the winner.
cwe · 2 assertions
{"description":"288","lang":"en"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:14c009cd9382f18c209e78ce9fb2e4df0c56c687055d482ced9e5c9f038c7bc9 · sha256:30f5c0ec42cc1bcb… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:14c009cd9382f18c209e78ce9fb2e4df0c56c687055d482ced9e5c9f038c7bc9 · sha256:30f5c0ec42cc1bcb… · /containers/adp/0/problemTypes/0/descriptions/0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"ONTAP 9","vendor":"NETAPP","versions":[{"lessThan":"9.19.1","status":"affected","version":"9.16.1","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:14c009cd9382f18c209e78ce9fb2e4df0c56c687055d482ced9e5c9f038c7bc9 · sha256:30f5c0ec42cc1bcb… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"H…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:14c009cd9382f18c209e78ce9fb2e4df0c56c687055d482ced9e5c9f038c7bc9 · sha256:30f5c0ec42cc1bcb… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
2 source assertions{"description":"288","lang":"en"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:14c009cd9382f18c209e78ce9fb2e4df0c56c687055d482ced9e5c9f038c7bc9 · sha256:30f5c0ec42cc1bcb… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:14c009cd9382f18c209e78ce9fb2e4df0c56c687055d482ced9e5c9f038c7bc9 · sha256:30f5c0ec42cc1bcb… · /containers/adp/0/problemTypes/0/descriptions/0
Source references
1 source assertion{"url":"https://security.netapp.com/advisory/NTAP-20260722-0001/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:14c009cd9382f18c209e78ce9fb2e4df0c56c687055d482ced9e5c9f038c7bc9 · sha256:30f5c0ec42cc1bcb… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.