Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior…
Priority LOW 25Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 are susceptible to a vulnerability which could allow an attacker to discover cluster, node and Active IQ Unified Manager specific information via AutoSupport telemetry data that is sent even when AutoSupport has been disabled.
Why it matters now
EPSS 0.00613 49th percentileScored 2026-11-07
Fix Fixed Active IQ Unified Manager: 9.10P1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Active IQ Unified Manager | before 9.10P1 | 9.10P1 | Patch available | CNA |
- Active IQ Unified Manager Vendor— Affected before 9.10P1 Fixed in 9.10P1 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:* | before 9.10 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* | before 9.10 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* | before 9.10 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:9.10:-:*:*:*:linux:*:* | 9.10 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:9.10:-:*:*:*:vmware_vsphere:*:* | 9.10 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:9.10:-:*:*:*:windows:*:* | 9.10 | Vulnerable | NetApp |
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:* Versions before 9.10 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions before 9.10 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* Versions before 9.10 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:9.10:-:*:*:*:linux:*:* Versions 9.10 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:9.10:-:*:*:*:vmware_vsphere:*:* Versions 9.10 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:9.10:-:*:*:*:windows:*:* Versions 9.10 Vulnerable ·NetApp
Remediation
- Fix · CNA Active IQ Unified Manager Fixed in 9.10P1
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23235
- 2026-10-03 Alias added: GHSA-7677-xwx4-r4m4
References
More NetApp Active Iq Unified Manager vulnerabilities
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2023-22374 Improper check for unusual conditions in Apple macOS KEVCVSS 3.1HIGH 8.8
- TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
- TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2021-02242 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer… KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2022-23235 · CVE Program
- CVE-2022-23235 · NVD
- FIRST EPSS
- GHSA-7677-xwx4-r4m4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences