CVE-2025-26514: Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Reflected Cross-Site Scripting vulnerability. Successful exploit could allow an attacker to view or modify configuration settings or add or modify user accounts but requires the attacker to know specific information about the target instance and then trick a privileged user into clicking a specially crafted link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26514?
CVE-2025-26514 is classified as a high severity vulnerability due to the potential for an attacker to exploit it to gain unauthorized access and control over sensitive configuration settings.
How do I fix CVE-2025-26514?
To remediate CVE-2025-26514, upgrade NetApp StorageGRID to version 11.8.0.15 or 11.9.0.8 or later.
What types of attacks can CVE-2025-26514 enable?
CVE-2025-26514 can enable reflected cross-site scripting attacks that allow attackers to view or modify configuration settings and user accounts.
Which versions of NetApp StorageGRID are affected by CVE-2025-26514?
Versions of NetApp StorageGRID prior to 11.8.0.15 and 11.9.0.8 are affected by CVE-2025-26514.
Is user data at risk with CVE-2025-26514?
Yes, CVE-2025-26514 poses a risk to user data as it allows unauthorized modifications to user accounts and configurations.