Home / Security / Advisories / NTAP-20260429-0007

NTAP-20260429-0007 — CVE-2026-23865 Java Platform Standard Edition Vulnerability in NetApp Products

Published 2026-04-29 · Updated 2026-06-24 · Status: Interim · Exploitation: Public · Severity: MEDIUM 5.3 · ONTAP affected: No — other NetApp product

Official advisory: NTAP-20260429-0007 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: OnCommand family · Brocade SAN firmware · SolidFire / NetApp HCI · SnapCenter | other NetApp product | highest CVSS: 5.3

CVEs in this advisory

CVE-2026-23865 — MEDIUM · CVSS 5.3 · site index

What the CVE records say

CVE-2026-23865 — An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.

Impact

Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data and an unauthorized ability to cause a partial Denial of Service (partial DOS) of Oracle Java SE.

Affected products

OnCommand Insight
Brocade SAN Navigator (SANnav)
NetApp SolidFire & HCI Management Node
SnapCenter Plug-in for VMware vSphere

References

What to do

Compare your installed product and version against the affected list above and the official advisory's affected-versions table.
Apply the fixed release named in the official advisory, or the documented workaround if no fix ships yet.
Limit management-plane exposure (BMC/management interfaces, web UIs, SNMP) until patched.
Track follow-ups in the site CVE index and the security RSS feed.