# NetApp vulnerabilities & exploitation

**CISA KEV** · **Ransomware**

> As of 2026-11-01, Threadlinqs tracks 6 NetApp CVEs, 4 in the CISA Known Exploited Vulnerabilities catalog, 1 used in ransomware campaigns, linked to 13 tracked threat campaigns and 12 named threat actors.

**Data as of:** 2026-11-01

## Exploitation timeline

Threadlinqs has recorded 6 NetApp CVEs published between 2021-12-15 and 2026-10-15. The busiest month was 2024-04 (1 new CVE). 4 of them (67%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked NetApp CVEs.

- [CVE-2021-44228](https://intel.threadlinqs.com/cve/CVE-2021-44228) — CRITICAL 10 · KEV · Ransomware · EPSS 100% · 2021-12-10
- [CVE-2023-41993](https://intel.threadlinqs.com/cve/CVE-2023-41993) — HIGH 8.8 · KEV · EPSS 24.3% · 2023-09-21
- [CVE-2023-0386](https://intel.threadlinqs.com/cve/CVE-2023-0386) — HIGH 7.8 · KEV · EPSS 7.9% · 2023-03-22
- [CVE-2022-0492](https://intel.threadlinqs.com/cve/CVE-2022-0492) — HIGH 7.8 · KEV · EPSS 5.5% · 2022-03-03
- [CVE-2023-29483](https://intel.threadlinqs.com/cve/CVE-2023-29483) — HIGH 7 · EPSS 1.9% · 2024-04-11
- [CVE-2026-22063](https://intel.threadlinqs.com/cve/CVE-2026-22063) — MEDIUM 6 · EPSS 0.1% · 2026-10-27

## Products affected

Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 28 distinct NetApp products are affected. The most frequently affected (top 20):

- Active Iq Unified Manager — 2 CVEs
- Bootstrap Os — 2 CVEs
- H300s — 2 CVEs
- H300s Firmware — 2 CVEs
- H410c — 2 CVEs
- H410c Firmware — 2 CVEs
- H410s — 2 CVEs
- H410s Firmware — 2 CVEs
- H500s — 2 CVEs
- H500s Firmware — 2 CVEs
- H700s — 2 CVEs
- H700s Firmware — 2 CVEs
- Hci Compute Node — 2 CVEs
- Oncommand Insight — 2 CVEs
- Brocade San Navigator — 1 CVE
- Cloud Insights — 1 CVE
- Cloud Insights Acquisition Unit — 1 CVE
- Cloud Insights Storage Workload Security Agent — 1 CVE
- Cloud Manager — 1 CVE
- Cloud Secure Agent — 1 CVE

## Threat activity

13 tracked threat campaigns reference NetApp products or exploit NetApp CVEs:

- [Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)](https://intel.threadlinqs.com/threat/TL-2026-4664) — HIGH — 2026-10-28
- [Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial Institutions](https://intel.threadlinqs.com/threat/TL-2026-4318) — HIGH — 2026-10-23
- [Proxyjacking campaign hijacks 143+ edge devices in 34 countries (D-Link, Ubiquiti, SAP) to resell bandwidth via Pawns.app, plus active exploitation of PAN-OS CVE-2026-0322](https://intel.threadlinqs.com/threat/TL-2026-4174) — HIGH — 2026-10-22
- [skynox7: Proxyjacking Edge Devices Into Residential Proxies (D-Link ShareCenter CVE-2024-3272/3273, UniFi Video CVE-2021-44228, SAP NetWeaver CVE-2025-31324)](https://intel.threadlinqs.com/threat/TL-2026-3649) — HIGH — 2026-10-15
- [DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec References](https://intel.threadlinqs.com/threat/TL-2026-2364) — CRITICAL — 2026-09-06
- [Chinese-Speaking Operator "Nie" Uses SecFlow AI Orchestration Framework (Claude, Qwen, DeepSeek) and GLUTTON Steganographic Webshell in Multi-Country Espionage Campaign](https://intel.threadlinqs.com/threat/TL-2026-2325) — HIGH — 2026-09-04
- [EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix Backdoor + Banking-Trojan Extension Campaign Adopted by Criminal, North Korean, and Iran-Linked Actors](https://intel.threadlinqs.com/threat/TL-2026-2273) — HIGH — 2026-09-01
- [LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)](https://intel.threadlinqs.com/threat/TL-2026-2094) — HIGH — 2026-08-21
- [Aquatic Panda (Earth Lusca) APT - Log4Shell Exploitation and Multi-Platform Backdoor Campaigns Targeting 17 Countries](https://intel.threadlinqs.com/threat/TL-2026-0986) — CRITICAL — 2026-06-28
- [Linux Kernel cgroups v1 release_agent Container Escape & Privilege Escalation (CVE-2022-0492) — Added to CISA KEV (Active Exploitation)](https://intel.threadlinqs.com/threat/TL-2026-0662) — CRITICAL — 2026-06-02
- [Hack-for-Hire Espionage Campaign Targeting MENA Civil Society via Predator/Intellexa Mercenary Spyware](https://intel.threadlinqs.com/threat/TL-2026-0333) — HIGH — 2026-04-08
- [APT41/Silver Dragon Expanding Enterprise Attack Surface — Google Drive C2, AppDomain Hijacking, Cloud/Supply Chain Targeting](https://intel.threadlinqs.com/threat/TL-2026-0292) — HIGH — 2026-03-27
- [Coruna iOS Exploit Kit — 23 Exploits Across 5 Chains Targeting iOS 13-17.2.1 (CVE-2021-30952, CVE-2023-41974, CVE-2023-43000 + 20 More)](https://intel.threadlinqs.com/threat/TL-2026-0186) — CRITICAL — 2026-03-06

## Threat actors targeting NetApp

Named threat actors attributed to campaigns that involve NetApp products or CVEs, with the number of linked campaigns:

- [Akira](https://intel.threadlinqs.com/actor/Akira) — 1 campaign
- [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) — 1 campaign
- [APT41](https://intel.threadlinqs.com/actor/APT41) — 1 campaign
- [Cl0p](https://intel.threadlinqs.com/actor/Cl0p) — 1 campaign
- [Cytrox](https://intel.threadlinqs.com/actor/Cytrox) — 1 campaign
- [DragonForce](https://intel.threadlinqs.com/actor/DragonForce) — 1 campaign
- [Earth Lusca](https://intel.threadlinqs.com/actor/Earth%20Lusca) — 1 campaign
- [LockBit](https://intel.threadlinqs.com/actor/LockBit) — 1 campaign
- [NoName057(16)](https://intel.threadlinqs.com/actor/NoName057(16)) — 1 campaign
- [Qilin](https://intel.threadlinqs.com/actor/Qilin) — 1 campaign
- [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 1 campaign
- [Storm-1567](https://intel.threadlinqs.com/actor/Storm-1567) — 1 campaign

## How to prioritise NetApp patching

This order follows the data Threadlinqs holds for NetApp, not a generic severity checklist:

- 4 of 6 NetApp CVEs (67%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2021-44228](https://intel.threadlinqs.com/cve/CVE-2021-44228), [CVE-2023-41993](https://intel.threadlinqs.com/cve/CVE-2023-41993), [CVE-2023-0386](https://intel.threadlinqs.com/cve/CVE-2023-0386).
- 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
- Outside KEV, the highest EPSS scores are [CVE-2023-29483](https://intel.threadlinqs.com/cve/CVE-2023-29483) (1.9%), [CVE-2026-22063](https://intel.threadlinqs.com/cve/CVE-2026-22063) (0.1%).
- 1 CVE scores Critical and 4 High on CVSS v3 (maximum 10, average 7.9); sequence these after KEV and high-EPSS items.
- 5 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-01 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/netapp
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp