Based on NetApp advisory NTAP-20261021-0021. Only facts present in that advisory record are asserted here.
Security ONTAP 9 CVE Advisory 2026-10-22What NetApp actually published
On 21 October 2026 NetApp added advisory NTAP-20261021-0021, October 2026 PHP Vulnerabilities in NetApp Products, to its product security listings. It carries two CVE IDs — CVE-2026-109618 and CVE-2026-109619 — and names ONTAP 9 as the affected product line. That product family is as specific as the record gets: no individual releases are called out.
The stated impact for the pair: disclosure of sensitive information, addition or modification of data, or denial of service. Those three outcomes cover a lot of ground, which is exactly why the fixing detail matters more than the CVE count.
Two words in the record do the real work: Interim, and Public
Status: Interim. NetApp has published the issue without completing the advisory — in practice, the fixed-release table is not settled yet. Exploitation: Public. The underlying weakness is publicly known: NetApp's own references point at the PHP project's 21 October 2026 release note and two php-src security advisories (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp).
Put together — a publicly known PHP flaw, in a product line most NetApp shops run, with no fixed release named — and this stops being a wait-and-see item. It is a track-daily item until the table fills in.
Why a PHP CVE lands on a storage array at all
ONTAP is not a PHP application server, but its management stack embeds web-facing components, and PHP is part of that embedded software. That is why the affected field says ONTAP 9 rather than naming a separately installable package: the component travels with the release.
The practical consequence is that remediation will arrive as an ONTAP release, not as something you patch on the side. This is upgrade planning, not hotfix work — which is also why the interim window is the right time to check what you are actually running. Background on the management surface is in our ONTAP security hardening reference.
What to do this week, while the advisory is interim
- Inventory ONTAP 9 clusters and their exact releases. You cannot map a fix table onto your estate until you know which releases you run;
cluster showplus per-node version output is enough to start. - Re-read the advisory, not the coverage. The fixed-release table will be filled in on that page. Community threads and aggregator headlines will not carry the authoritative list. Our CVE index tracks both IDs alongside the rest of the October batch.
- Ask who can reach the management plane. The advisory names no attack vector, so do not invent one — but the exposure question is legitimate. The REST API reference maps the management endpoints worth reviewing.
- Do not apply a folk workaround. With no vendor workaround published, disabling services by guesswork converts a patch-management task into an outage.
The takeaway
Two CVEs, one interim advisory, public exploitation, and a product family instead of a version list. That is the shape of a security item you track for a week or two rather than close today. The cheapest durable control is knowing your ONTAP release inventory cold — that is what turns “is this me?” into a ten-minute answer the moment the fix table lands.
Sources: NetApp NTAP-20261021-0021 · PHP release note, 21 Oct 2026 · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp