CVE-2026-22055: Active IQ OneCollect Auth Bypass Flaw

CVE-2026-22055 Overview

CVE-2026-22055 affects NetApp Active IQ OneCollect version 2.7.3. The product contains hard-coded credentials embedded within the application. An authenticated attacker with low privileges can leverage these credentials to perform unauthorized AutoSupport operations. The vulnerability falls under the Hardcoded Credentials class [CWE-798] and represents a configuration and design flaw.

The issue requires network access and low-privilege authentication to exploit. It does not directly compromise confidentiality, integrity, or availability of the vulnerable component, but it impacts the confidentiality of a subsequent system through unauthorized AutoSupport actions.

Critical Impact

Authenticated low-privilege attackers can invoke AutoSupport operations they should not have access to, potentially exposing diagnostic data sent from the vulnerable host to downstream systems.

Affected Products

• NetApp Active IQ OneCollect version 2.7.3

Discovery Timeline

• 2026-06-03 - CVE-2026-22055 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-22055

Vulnerability Analysis

NetApp Active IQ OneCollect is a data collection utility used to gather diagnostic information from NetApp storage environments and forward it through AutoSupport channels. Version 2.7.3 ships with credentials embedded directly in the application binaries or configuration. Any actor with knowledge of these static credentials and the ability to authenticate to the system at a low privilege level can use them to issue AutoSupport operations.

AutoSupport is the telemetry and diagnostic transport mechanism used by NetApp products. Unauthorized invocation of AutoSupport operations can trigger data collection, file transmission, or system probing functions that should be restricted to administrative roles.

Root Cause

The root cause is the inclusion of static, hard-coded credentials inside the OneCollect 2.7.3 distribution. Because the credentials are fixed at build time, every deployment of the same version shares the identical secret. Standard credential management controls such as rotation, revocation, or per-instance secrets cannot mitigate the issue without a vendor patch.

Attack Vector

The attack vector is network based. An attacker must already hold low-privilege authenticated access to interact with the OneCollect interface. Once authenticated, the attacker supplies the hard-coded credentials to access AutoSupport functionality reserved for higher privilege roles. No user interaction is required, and the attack complexity is low.

No verified public exploit code is available. Refer to the NetApp Security Advisory for vendor-published technical details.

Detection Methods for CVE-2026-22055

Indicators of Compromise

• Unexpected AutoSupport operations initiated from accounts that do not normally trigger them.
• AutoSupport message generation outside of scheduled collection windows.
• Authentication events to Active IQ OneCollect from unusual source addresses or service accounts.

Detection Strategies

• Inventory all hosts running Active IQ OneCollect and identify any running version 2.7.3.
• Correlate OneCollect authentication logs with subsequent AutoSupport operation logs to flag low-privilege users invoking privileged actions.
• Alert on AutoSupport payload transmissions that deviate from normal cadence, size, or destination.

Monitoring Recommendations

• Forward Active IQ OneCollect audit logs and AutoSupport transmission records to a centralized log platform for retention and correlation.
• Baseline normal AutoSupport activity per host and alert on deviations.
• Monitor for repeated authentication attempts from low-privilege accounts that immediately precede AutoSupport activity.

How to Mitigate CVE-2026-22055

Immediate Actions Required

• Identify and inventory all systems running Active IQ OneCollect 2.7.3.
• Restrict network access to OneCollect management interfaces to trusted administrative hosts only.
• Review accounts authorized to authenticate to OneCollect and remove unnecessary low-privilege access.
• Audit recent AutoSupport activity for anomalies consistent with unauthorized invocation.

Patch Information

NetApp has published advisory NTAP-20260603-0002 describing the vulnerability. Consult the NetApp Security Advisory for the current list of fixed releases and apply the vendor-supplied update to Active IQ OneCollect as soon as it is available for your environment.

Workarounds

• Limit network exposure of the OneCollect host using firewall rules or segmentation until a patched version is deployed.
• Disable or quiesce Active IQ OneCollect 2.7.3 if the collection function is not currently required.
• Enforce least-privilege on all accounts permitted to authenticate to OneCollect and remove accounts that are no longer needed.