Skip to main content
NetApp Knowledge Base

Vulnerability CVE-2026-49844 in NetApp Manageability SDK 9.8P10

  1. Last updated
  2. Save as PDF
Views:
3
Visibility:
Public
Votes:
0
Category:
netapp-manageability-sdk
Specialty:
tools
Last Updated:

Applies to

  • NetApp Manageability SDK (NMSDK)
  • Apache Log4j versions 2.13.1 through 2.25.4
  • Linux management virtual machines running NMSDK
  • ONTAP automation environments using NMSDK

Issue

  • A vulnerability scan reports the following finding on a Linux management VM running NetApp Manageability SDK (NMSDK) 9.8P10.
  • The scan identifies Apache Log4j version 2.19.0 within zexplore.jar and manageontap-9.8P10.jar and recommends fixed version 2.25.5 for Apache Log4j.
  • Plugin Output:

Path: /data/netapp-manageability-sdk-9.8P10/zedi/zexplore.jar
Installed version: 2.19.0
Fixed version: 2.25.5

Path: /data/netapp-manageability-sdk-9.8P10/lib/java/classes/manageontap-9.8P10.jar
Installed version: 2.19.0
Fixed version: 2.25.5

  • Description:

The version of Apache Log4j on the remote host is affected by a vulnerability (CVE-2026-49844): Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. 

  • Key symptoms:

Vulnerability detected in NMSDK JAR files due to outdated Log4j.
Customer asks if upgrading NMSDK to 9.8P12 will resolve the issue.
Concern if affected JAR files will be updated automatically with SDK upgrade.
Requests for guidance on remediation or workarounds.

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.