Based on NetApp Knowledge Base — “Are NetApp ONTAP Systems Impacted by CVE-2026-55203 and CVE-2026-55204” (Applies-to and Issue sections; last updated 2026-10-12). Only claims present in the KB’s public sections are asserted here.
Security ONTAP 9 2026-10-12What NetApp published
NetApp on 2026-10-12 updated a public Knowledge Base article that answers a question ONTAP administrators ask every time a new CVE lands in a supporting component: are ONTAP systems impacted by CVE-2026-55203 and CVE-2026-55204? The KB describes both as HAProxy-related vulnerabilities. Its Applies-to section lists NetApp ONTAP 9 and all NetApp ONTAP-based hardware and platforms.
What the article actually covers
The KB frames the work as a customer-requested assessment and enumerates exactly the questions it addresses:
- Whether HAProxy or affected components are used by ONTAP.
- Whether specific ONTAP releases are vulnerable.
- Which NetApp products are affected.
- Whether remediation or upgrades are required.
- Whether NetApp plans to publish a Security Advisory or Security Bulletin for these CVEs.
What is not public
The cause, verification and resolution sections sit behind a NetApp sign-in. The public page states the scope and the questions — not the assessment. So “are ONTAP systems impacted” is, at the time of writing, an item NetApp answers per customer request rather than a blanket published verdict. We assert nothing beyond the KB’s own public wording, and no number, version or CVE beyond the two identifiers above.
What ONTAP admins should do
Two HAProxy-related CVEs arriving together is a cue to check your own exposure independently of any vendor verdict:
- Open the KB article in full (NetApp sign-in) and, if your release is not already covered, request NetApp’s assessment.
- Watch NetApp’s official security channel — our advisory digest tracks the bulletins — for a Security Advisory or Bulletin on these two CVEs.
- Inventory any HAProxy or reverse-proxy front ends you run in front of ONTAP management or data services and pin their versions, so a component-level CVE can be matched to your estate quickly.
For the wider posture around hardening ONTAP management access, start at the security hub; release-level detail lives in the reference library.
Bottom line
There is a public, dated NetApp article on the question and its substantive assessment is gated. Until a Security Advisory or Bulletin appears, treat the ONTAP impact of CVE-2026-55203 and CVE-2026-55204 as unconfirmed and verify against NetApp’s own channels rather than third-party summaries.
Sources: NetApp Knowledge Base — “Are NetApp ONTAP Systems Impacted by CVE-2026-55203 and CVE-2026-55204” (public Applies-to and Issue sections; updated 2026-10-12).