EN PT-BR
← Voltar ao feed
high exploit público

CERT-FR Advisory: Multiple ONTAP 9 Vulnerabilities Enable Remote Code Execution

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 21:00 · coletado há 1 hora

CERT-FR published advisory CERTFR-2026-AVI-1446 on 03 November 2026 covering multiple vulnerabilities in NetApp ONTAP 9 that allow an attacker to achieve remote arbitrary code execution. The flaws affect a broad range of ONTAP 9.x branches, from 9.12.x through 9.19.x, prior to specific hotfixed or patched versions. The advisory references NetApp's security bulletin NTAP-20261021-0021, published the same day, and cites two CVE identifiers. Administrators are directed to the vendor bulletin for applicable fixes.

Entenda a falha

A vulnerabilidade

Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect NetApp ONTAP 9 and let an attacker achieve remote arbitrary code execution, according to CERT-FR. The sources do not say which component is affected, what access or authentication is needed, or how the two CVEs differ in severity. Affected: 9.12.x before 9.12.1P20HF1, 9.13.x before 9.13.1P21HF1, 9.14.x before 9.14.1P18HF1, 9.15.x before 9.15.1P20HF1, 9.16.x before 9.16.1P16HF1, 9.17.x before 9.17.1P11HF1, 9.18.x before 9.18.1P8HF1, and 9.19.x before 9.19.1P3HF1 or 9.19.1P4. Those versions are the fixed releases, described in NetApp bulletin NTAP-20261021-0021.

Como foi descoberta

CERT-FR says only that multiple vulnerabilities were discovered in NetApp ONTAP 9. It does not say who found them or how. NetApp published bulletin NTAP-20261021-0021 on 03 November 2026, and CERT-FR published advisory CERTFR-2026-AVI-1446 the same day, pointing administrators to the vendor bulletin for fixes.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 14:26.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • Vulnerabilities allow remote arbitrary code execution in NetApp ONTAP 9.
  • Affected versions: 9.12.x < 9.12.1P20HF1, 9.13.x < 9.13.1P21HF1, 9.14.x < 9.14.1P18HF1, 9.15.x < 9.15.1P20HF1, 9.16.x < 9.16.1P16HF1, 9.17.x < 9.17.1P11HF1, 9.18.x < 9.18.1P8HF1, 9.19.x < 9.19.1P3HF1 or 9.19.1P4.
  • Tracked as CVE-2026-109618 and CVE-2026-109619.
  • Referenced vendor bulletin: NTAP-20261021-0021 (03 November 2026).

Remediação

  • Apply the hotfixes/patches referenced in NetApp's security bulletin NTAP-20261021-0021.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 02/11/2026 21:00 · coletado 04/11 14:01 primeiro registro

    CERT-FR Advisory: Multiple ONTAP 9 Vulnerabilities Enable Remote Code Execution

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1446 on 03 November 2026 covering multiple vulnerabilities in NetApp ONTAP 9 that allow an attacker to achieve remote arbitrary code execution. The flaws affect a broad range of ONTAP 9.x branches, from 9.12.x through 9.19.x, prior to specific hotfixed or patched versions. The advisory references NetApp's security bulletin NTAP-20261021-0021, published the same day, and cites two CVE identifiers. Administrators are directed to the vendor bulletin for applicable fixes.

    Technical Details

    • Vulnerabilities allow remote arbitrary code execution in NetApp ONTAP 9.
    • Affected versions: 9.12.x < 9.12.1P20HF1, 9.13.x < 9.13.1P21HF1, 9.14.x < 9.14.1P18HF1, 9.15.x < 9.15.1P20HF1, 9.16.x < 9.16.1P16HF1, 9.17.x < 9.17.1P11HF1, 9.18.x < 9.18.1P8HF1, 9.19.x < 9.19.1P3HF1 or 9.19.1P4.
    • Tracked as CVE-2026-109618 and CVE-2026-109619.
    • Referenced vendor bulletin: NTAP-20261021-0021 (03 November 2026).

    Remediation

    • Apply the hotfixes/patches referenced in NetApp's security bulletin NTAP-20261021-0021.