Home / Security / Advisories / NTAP-20251003-0011

NTAP-20251003-0011 — CVE-2025-9230 OpenSSL Vulnerability in NetApp Products

Published 2025-10-03 · Updated 2026-09-17 · Status: Interim · Exploitation: Public · Severity: HIGH 7.5 · ONTAP affected: Yes

Official advisory: NTAP-20251003-0011 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Active IQ Unified Manager · NetApp Console / BlueXP · SolidFire / NetApp HCI · ONTAP · SnapManager / Snap utilities · Other NetApp products | ONTAP-relevant | highest CVSS: 7.5

CVEs in this advisory

CVE-2025-9230 — HIGH · CVSS 7.5 · site index

What the CVE records say

CVE-2025-9230 — Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

Impact

Successful exploitation of this vulnerability could lead to Denial of Service (DoS).

Affected products

Active IQ Unified Manager for Linux
Active IQ Unified Manager for VMware vSphere
NetApp Console Agent Container (adc)
NetApp Console Agent Container (cbs)
NetApp Console Agent Container (cbs-backend)
NetApp HCI Baseboard Management Controller (BMC) - H610S
ONTAP Antivirus Connector
SnapManager for Hyper-V
AFF BIOS - A700s
Active IQ Config Advisor
Active IQ OneCollect
FAS/AFF BIOS - 8300/8700/A400/C400

References

https://openssl-library.org/news/secadv/20250930.txt ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.