CVE-2024-21985 - CVE House
Back to Database
Status published High CVE-2024-21985

Privilege Escalation Vulnerability in ONTAP 9

Vulnerability Description

ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-21985

Credits & Attribution

No credits recorded in the NVD database.

References

More from NetApp

View All →
CVE-2025-26517
CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Medium 5.4
CVE-2025-26516
CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Medium 5.3
CVE-2025-26515
CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)
High 7.5
CVE-2025-26514
CVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Medium 6.4
CVE-2025-26513
The installer for SAN Host Utilities for Windows versions prior...
High 7

Affected Vendor

Affected Software

ONTAP 9
Vulnerable Versions:
9.0, 9.10.1, 9.11.1, 9.12.1, 9.13.1

Timeline

Official Publish: January 26th, 2024
Last Modified: May 29th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weaknesses (CWE)

CWE-269

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion