CVE-2025-26514 CVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Attackers can execute scripts in privileged users' browsers to view or modify configuration settings and user accounts via crafted links.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-26514?
CVE-2025-26514 is a medium-severity cross-site scripting vulnerability in Netapp Storagegrid, published on 19 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Reflected Cross-Site Scripting vulnerability. Successful exploit could allow an attacker to view or modify configuration settings or add or modify user accounts but requires the attacker to know specific information about the target instance and then trick a privileged user into clicking a specially crafted link.
Weakness: CWE-79
Which versions are affected by CVE-2025-26514?
It affects 1 product.
Products include Netapp Storagegrid.
How do I fix CVE-2025-26514?
No fix has been published for CVE-2025-26514 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-26514 being exploited?
There is no known exploitation of CVE-2025-26514 in the wild and no public exploit code.
Other vulnerabilities in Netapp Storagegrid
- CVE-2025-25291 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
- CVE-2025-25292 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
- CVE-2025-26515 CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)
- CVE-2022-38734 Denial of service in Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
- CVE-2022-23233 Denial of service in StorageGRID (formerly StorageGRID Webscale)
Sources
Also known as GHSA-fgcw-xmgg-245q.