Medium severity · published Apr 20, 2026
CVE-2026-22051
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability. Successful exploit could allow an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results that they do not have access to.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
StorageGRID (formerly StorageGRID Webscale) · NETAPP
before 11.9.0.13; before 12.0.0.6 · source: vendor
ST
Storagegrid · Netapp
before 11.9.0.13; 12.0 before 12.0.0.6 · source: NVD
Affected product
SF
StorageGRID (formerly StorageGRID Webscale)
NETAPP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22051
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22051
Vendor Advisory
https://security.netapp.com/advisory/ntap-20260420-0001
More from StorageGRID (formerly StorageGRID Webscale)
6.0
CVE-2026-22063
CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products