Trust Center
At NetApp, trust is more than a principle, it’s a promise. Whether you're a customer, prospect, or part of our sales team, this portal is your gateway to understanding how we protect data and uphold our security commitments.
Powered by SafeBase, this center provides real-time visibility into our security and compliance program. You’ll find up-to-date information on how we monitor, test, and continuously improve our controls, so you can speak confidently about our practices, make informed decisions, and trust that your data is in safe hands.
Self-Service Audit Evidence
This section is reserved for customers conducting a self-service audit. Contact us to learn more or request access.
Trust Center Updates
PHP Vulnerabilities
NetApp is aware of the recently disclosed PHP vulnerabilities, commonly referred to as "PHP2Shell", that could potentially allow remote code execution if successfully exploited.
As part of our standard security response process, NetApp promptly assessed the impact of these vulnerabilities across our products. Based on our investigation, ONTAP is affected only by a single vulnerability.
NetApp has released a HotFix (HF) to address the impacted component. A HotFix is a fully supported Generally Available (GA) release that provides time-sensitive security and reliability updates outside of the normal release cycle. HotFixes are approved for broad customer adoption and are subsequently incorporated into future maintenance and feature releases.
Customers are encouraged to review the NetApp Product Security Advisory for affected versions, remediation guidance, and download information. For additional details, please refer to the NetApp Product Security page.
NetApp is aware of the publicly disclosed PHP2Shell vulnerabilities and is conducting an ongoing assessment to determine potential impact across our technology landscape. To date, our review has identified certain ONTAP components requiring further assessment and remediation activity.
Engineering and security teams are actively developing, testing, and validating software updates to address the identified affected ONTAP components. At this time, we have found no evidence of exploitation affecting the identified ONTAP components or associated customer data.
Customers should review PHP deployments within their own environments, apply applicable vendor-provided security updates, and follow their established vulnerability management and monitoring processes. For the latest remediation measures, please refer to the Product Security Advisory.