CVE-2026-22049Patch(netapp / ontap)

CVE-2026-22049 - NetApp ONTAP WebAuthn Authentication Bypass Vulnerability ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication configured may be susceptible to a vulnerability related to the Relying Party ID. If successfully exploited, an attacker with valid credentials could bypass MFA. Organizations using affected NetApp ONTAP environments should review vendor guidance, validate MFA configurations, apply available security updates, and monitor for unusual authentication activity. Strong security starts with fast visibility and action. If your team needs help assessing exposure or strengthening MFA and access controls, Vistem Solutions is here to help. 📩 Contact us: sales@vistem.com #Cybersecurity #NetApp #ONTAP #MFA #VulnerabilityManagement #CVE #CyberResilience #ITSecurity #SecurityCompliance #VistemSolutions #SecureInnovation https://cvefeed.io/vuln/detail/CVE-2026-22049?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer

🚨High - NetApp ONTAP WebAuthn MFA Bypass (CVE-2026-22049) NetApp ONTAP 9.16.1 and higher, when configured with WebAuthn multi-factor authentication, contain a flaw related to the WebAuthn Relying Party ID. An attacker who already holds valid credentials can exploit it to bypass the MFA step entirely. This defeats the second factor protecting management access to enterprise storage, so a phished or stuffed password is no longer stopped by MFA. Impact is high across confidentiality, integrity, and availability. CVSS 8.7. 👉Affected: ONTAP 9.16.1 up to 9.19.1 with WebAuthn MFA configured. Upgrade to ONTAP 9.19.1.