Published 2026-10-29. Based on NetApp Knowledge Base article 226137, NetApp advisory NTAP-20261023-0012, and the upstream Erlang/OTP advisory. Checked October 29, 2026.
SECURITY SNAPCENTER CVE-2026-89422 2026-10-29The answer: yes
NetApp says SnapCenter 6.2.3 installs Erlang/OTP 27.3.4.16 and that this Erlang release is affected by CVE-2026-89422. The upstream project identifies 27.3.4.18 as the patched release on the OTP 27 branch, placing 27.3.4.16 below that boundary.
What the vulnerability does
CVE-2026-89422 is a critical TLS 1.3 server-authentication bypass in the Erlang/OTP ssl client. A malicious server—or an on-path attacker able to answer the connection—can make an affected client accept a TLS 1.3 session without validating the server certificate. The upstream advisory scores it 9.3 (Critical) and says a successful attacker can read data sent by the client and forge responses.
This is a client-side condition: the vulnerable Erlang process must initiate a TLS 1.3 connection through the affected code path. The version match establishes exposure; it does not by itself prove that a particular SnapCenter workflow is exploitable.
Affected NetApp products and status
NetApp advisory NTAP-20261023-0012 lists SnapCenter, SnapCenter Plug-in for VMware vSphere, ONTAP tools for VMware vSphere 10, and the ONTAP Select Deploy administration utility as affected product families. Its status is Interim. NetApp reports public discussion of the vulnerability; that is not the same as a statement that active exploitation has been observed. Neither the NetApp summary nor the upstream advisory cited here reports known active exploitation.
For product context and supported release links, use the SnapCenter reference. Do not replace the Erlang runtime independently unless NetApp Support explicitly directs it: SnapCenter ships and services the bundled component as part of the product.
First checks for administrators
- Record the product build. In SnapCenter, capture the exact server version and patch level; do the same for any SnapCenter Plug-in for VMware vSphere appliance.
- Confirm the bundled runtime. On the SnapCenter Server, record the Erlang/OTP release from the installed Erlang runtime. If it is 27.3.4.16, it matches the configuration NetApp's KB explicitly calls affected.
- Inventory outbound TLS paths. Identify HTTPS, database, messaging, or other TLS connections initiated by the SnapCenter host, then review whether an untrusted host or an on-path attacker could answer them. This prioritizes exposure; it does not change the affected-version determination.
- Check the live NetApp advisory. Compare every installed product and version with the affected-products and remediation tables in NTAP-20261023-0012 before scheduling a change.
- Preserve evidence. Retain the SnapCenter version, Erlang version, relevant service logs, and scanner finding for the change record or NetApp Support case.
Remediation, without unsupported component swaps
The upstream Erlang project recommends upgrading to a patched OTP release; for the OTP 27 line it lists 27.3.4.18. It offers restricting affected clients to TLS 1.2 as a temporary upstream workaround and says there is no configuration that both keeps TLS 1.3 and mitigates the flaw.
That upstream workaround is not automatically a supported SnapCenter procedure. For SnapCenter, apply the fixed product release or mitigation named by NetApp when it appears in the advisory, and involve NetApp Support if the Interim table does not yet provide a fixed version for the installed branch. Avoid manually replacing Erlang or changing RabbitMQ/Erlang TLS settings on a production SnapCenter host without product-specific guidance.