Home / Security / Advisories / NTAP-20251224-0007

NTAP-20251224-0007 — CVE-2025-66035 Angular Vulnerability in NetApp Products

Published 2025-12-24 · Updated 2026-10-06 · Status: Interim · Exploitation: Public · Severity: HIGH 7.7 · ONTAP affected: Yes

Official advisory: NTAP-20251224-0007 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: ONTAP · Active IQ Unified Manager · Other NetApp products | ONTAP-relevant | highest CVSS: 7.7

CVEs in this advisory

CVE-2025-66035 — HIGH · CVSS 7.7 · site index

What the CVE records say

CVE-2025-66035 — Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

Impact

Successful exploitation of this vulnerability could lead to disclosure of sensitive information.

Affected products

ONTAP Select Deploy administration utility
Active IQ Config Advisor
Active IQ OneCollect
NetApp XCP NFS
NetApp XCP SMB
ONTAP tools for VMware vSphere 10

References

https://nvd.nist.gov/vuln/detail/CVE-2025-66035 ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.