How severe is CVE-2021-27006?

CVE-2021-27006 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2021-27006 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-27006?

CVE-2021-27006 affects Netapp Storagegrid. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-27006?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-27006 published?

CVE-2021-27006 was published on 2021-12-23 and last updated on 2026-06-17.

CVE-2021-27006

CVE-2021-27006 is a medium-severity vulnerability in Netapp Storagegrid with a CVSS 3.x base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 4.4)
CVSS v2: 2.1
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Netapp Storagegrid
Published: 2021-12-23
Last modified: 2026-06-17

Description

StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may allow an administrative user to escalate their privileges and modify settings in SANtricity System Manager.

Frequently asked questions

What is CVE-2021-27006?: StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may allow an administrative user to escalate their privileges and modify settings in SANtricity System Manager.
How severe is CVE-2021-27006?: CVE-2021-27006 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2021-27006 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-27006?: CVE-2021-27006 affects Netapp Storagegrid. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-27006?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-27006 published?: CVE-2021-27006 was published on 2021-12-23 and last updated on 2026-06-17.

References

https://security.netapp.com/advisory/ntap-20211221-0001/

Affected products (1)

cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*

More vulnerabilities in Netapp Storagegrid

CVE-2025-25292 — Critical (CVSS 9.8): ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass…
CVE-2025-25291 — Critical (CVSS 9.8): ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass…
CVE-2022-37434 — Critical (CVSS 9.8): zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip…
CVE-2021-39275 — Critical (CVSS 9.8): ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted…
CVE-2018-1312 — Critical (CVSS 9.8): In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent…
CVE-2017-3167 — Critical (CVSS 9.8): In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules…

All CVEs affecting Netapp Storagegrid →