CVE-2026-22063

Received Received - Intake

eMudhra Intermediate CA Private Key Compromise Affecting NetApp Products

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: NetApp, Inc.

Description

The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-22063

EUVD

EUVD-2026-111406

Affected Vendors & Products

Vendor	Product	Version / Range
NetApp	ONTAP 9	0
NetApp	StorageGRID (formerly StorageGRID Webscale)	0
NetApp	E-Series SANtricity OS Controller Software	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the compromise of private keys for eight eMudhra intermediate CA certificates. While not a software flaw, it affects NetApp products that rely on these certificates for secure communications. eMudhra revoked the affected certificates on October 18, 2026.

Detection Guidance

This vulnerability involves compromised intermediate CA certificates, not a software flaw. Detection requires checking for affected certificates in your PKI infrastructure. Review certificate stores for the eight revoked eMudhra intermediate CA certificates. Use commands like 'openssl x509 -in cert.pem -text' to inspect certificates and verify their issuer against the revoked list.

Impact Analysis

The compromise could allow attackers to impersonate trusted certificates, enabling man-in-the-middle attacks or decrypting sensitive communications. NetApp products using these certificates may be vulnerable to unauthorized access or data breaches.

Mitigation Strategies

Immediately revoke and replace any affected certificates in your infrastructure. Update trust stores to exclude the compromised intermediate CAs. For NetApp products, apply vendor patches or updates as recommended by NetApp. Monitor CRLs and OCSP responses for the revoked certificates.

Hi! I’m here to help you understand CVE-2026-22063. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70