Article Details
Scrape Timestamp (UTC): 2025-03-27 06:08:54.425
Source: https://thehackernews.com/2025/03/netapp-snapcenter-flaw-could-let-users.html
Original Article Text
Click to Toggle View
NetApp SnapCenter Flaw Could Let Users Gain Remote Admin Access on Plug-In Systems. A critical security flaw has been disclosed in NetApp SnapCenter that, if successfully exploited, could allow privilege escalation. SnapCenter is an enterprise-focused software that's used to manage data protection across applications, databases, virtual machines, and file systems, offering the ability to backup, restore, and clone data resources. The vulnerability, tracked as CVE-2025-26512, carries a CVSS score of 9.9 out of a maximum of 10.0. "SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed," the data infrastructure company said in an advisory published this week. CVE-2025-26512 has been addressed in SnapCenter versions 6.0.1P1 and 6.1P1. There are currently no workarounds that address the issue. While there is no evidence that the shortcoming has been exploited in the wild, it's essential that organizations apply the latest updates to safeguard against potential threats.
Daily Brief Summary
A critical vulnerability was found in NetApp SnapCenter, potentially enabling privilege escalation.
The flaw, identified as CVE-2025-26512, has a high severity rating with a CVSS score of 9.9.
SnapCenter versions up to 6.0.1P1 and 6.1P1 are affected, impacting data management across various platforms.
Users authenticated on the SnapCenter Server could escalate privileges to admin on systems with SnapCenter plug-ins.
No workarounds are available; updating to fixed versions 6.0.1P1 or 6.1P1 is essential.
Although no in-the-wild exploitation has been reported, organizations are urged to install updates immediately to mitigate risks.