GovernmentFrance Official institution
NetApp storage firmware flaw allows privilege escalation
French cyber agency CERT-FR has warned of a flaw in NetApp storage hardware that lets an attacker gain higher access rights than they should have. The affected FAS and AFF BIOS firmware covers several model lines, and each has a minimum fixed firmware version. NetApp's own security bulletin, dated 28 October 2026, holds the patches.
What does it mean?
Some NetApp storage devices have a weak spot that could let someone take control they should not have. The fix is a BIOS firmware update, which is the low-level software that starts the hardware. Owners of the listed models should install the version named in NetApp's bulletin.
Who is affected?
Organizations running the listed NetApp FAS or AFF storage systems with older BIOS firmware.