Snapshot Expiry Bypass in NetApp ONTAP Allows Privileged Remote Attack

Publication date: 2026-01-12

Last updated on: 2026-01-12

Assigner: NetApp, Inc.

Description

ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-12

Last Modified

2026-01-12

Generated

2026-07-06

AI Q&A

2026-01-13

EPSS Evaluated

2026-07-05

NVD

CVE-2026-22050

Affected Vendors & Products

Vendor	Product	Version / Range
netapp	ontap	to 9.16.1P9 (exc)
netapp	ontap	to 9.17.1P2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 when snapshot locking is enabled. It allows a privileged remote attacker to set the snapshot expiry time to none, potentially preventing snapshots from expiring as intended.

Impact Analysis

The vulnerability could allow a privileged remote attacker to prevent snapshots from expiring by setting their expiry time to none. This may lead to storage management issues such as accumulation of snapshots, increased storage consumption, and potential disruption of backup or recovery processes.

Hi! I’m here to help you understand CVE-2026-22050. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70