CVE-2018-5488: netapp santricity products Improper Input Validation
Vulnerability summary
CVE-2018-5488 is a critical (CVSS 9.8) Improper Input Validation vulnerability in netapp santricity products. EPSS estimates a 3.78% chance of exploitation in the next 30 days, higher than 89.9% of scored vulnerabilities.
Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 4% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 13-06-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.78%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
Decrease -0.14 pp
From 3.92% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp3 products
- santricity productsSANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001
- santricity_storage_manager≥ 11.30.0x00.0004, ≤ 11.42.0x00.0001
- santricity_web_services_proxy≥ 1.10.x000.0002, ≤ 2.12.x000.0002
1 vendor · 3 products