CVE-2026-22063: Medium severity NetApp NetApp products vulnerability
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to the compromised intermediate CA keys?
Organizations that trust certificates chaining through any of the eight affected eMudhra intermediate CAs may be exposed to fraudulent certificates issued before revocation. The affected intermediates were revoked on October 18, 2026.
Does this issue require an attacker to compromise a NetApp system first?
No. The CVSS vector indicates no privileges are required, but exploitation has high attack complexity, requires a specific attack condition, and requires user interaction. The impact described is confidentiality only.
How can I determine whether my environment is affected?
Review the certificate chains trusted or used by impacted NetApp products and identify whether they include any of the eight eMudhra intermediate certificates whose private keys were compromised. The provided data does not identify the affected intermediate certificate names or specific NetApp products.