NTAP-20230818-0011 — CVE-2022-23221 H2 Database Vulnerability in NetApp Products

Product family: Active IQ Unified Manager · E-Series / SANtricity · Other NetApp products · ONTAP · OnCommand family · SnapCenter · StorageGRID  |  ONTAP-relevant

CVEs in this advisory

• CVE-2022-23221 · site index

Impact

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS).

Affected products

• Active IQ Unified Manager for Linux
• Active IQ Unified Manager for Microsoft Windows
• Active IQ Unified Manager for VMware vSphere
• E-Series SANtricity Unified Manager and Web Services Proxy
• Element Plug-in for vCenter Server
• MetroCluster Tiebreaker for clustered Data ONTAP
• OnCommand Insight
• OnCommand Workflow Automation
• SANtricity Storage Plugin for vCenter
• SnapCenter Plug-in for VMware vSphere/BlueXP backup and Recovery for Virtual Machine
• StorageGRID (formerly StorageGRID Webscale)

What to do

1. Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
2. If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
3. If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
4. Harden in parallel: security hardening baseline and ransomware protection on ONTAP.

Related reading

• Common ONTAP problems (FAQ) — plain-language symptoms and fixes
• ONTAP security hardening — baseline lockdown guidance
• Ransomware protection on ONTAP — SnapLock, SnapMirror vaulting, Anomaly Detection
• ONTAP error messages index — EMS/WAFL/NFS/SnapMirror messages
• Every NetApp advisory published in 2023

Browse all ONTAP CVEs → · Security hub