How severe is CVE-2024-21987?

CVE-2024-21987 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2024-21987 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-21987?

CVE-2024-21987 affects Netapp Snapcenter. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-21987?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-21987 have an EU (EUVD) identifier?

Yes. CVE-2024-21987 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19593.

When was CVE-2024-21987 published?

CVE-2024-21987 was published on 2024-02-16 and last updated on 2026-06-17.

CVE-2024-21987

CVE-2024-21987 is a medium-severity vulnerability in Netapp Snapcenter with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-19593
Weakness: CWE-863
Affected product: Netapp Snapcenter
Published: 2024-02-16
Last modified: 2026-06-17

Description

SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings

Frequently asked questions

What is CVE-2024-21987?: SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings
How severe is CVE-2024-21987?: CVE-2024-21987 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2024-21987 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-21987?: CVE-2024-21987 affects Netapp Snapcenter. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-21987?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-21987 have an EU (EUVD) identifier?: Yes. CVE-2024-21987 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19593.
When was CVE-2024-21987 published?: CVE-2024-21987 was published on 2024-02-16 and last updated on 2026-06-17.

References

https://security.netapp.com/advisory/ntap-20240216-0001/

Affected products (1)

cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:*

More vulnerabilities in Netapp Snapcenter

CVE-2021-44228 — Critical (CVSS 10.0): Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in…
CVE-2025-26512 — Critical (CVSS 9.9): SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated…
CVE-2023-1096 — Critical (CVSS 9.8): SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a…
CVE-2022-33980 — Critical (CVSS 9.8): Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and…
CVE-2022-2274 — Critical (CVSS 9.8): The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA…
CVE-2021-3711 — Critical (CVSS 9.8): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().…

All CVEs affecting Netapp Snapcenter →

Other CWE-863 (Incorrect Authorization) vulnerabilities

CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →