NetApp ONTAP tools for VMware vSphere: Remote denial of service and data integrity impact (CVE-2023-28840)
A vulnerability in NetApp ONTAP tools for VMware vSphere 10 (CVE-2023-28840) allows a remote attacker to trigger a denial of service and compromise data integrity, with no fix planned for the Astra Control Provisioner component.
CVE search metadata
CVE search record: CVE-2023-28840. KEV: no. Product: ONTAP tools for VMware vSphere (< 10.5P2), Astra Control Provisioner. Brief: NetApp ONTAP tools for VMware vSphere: Remote denial of service and data integrity impact (CVE-2023-28840). Brief link: https://feed.craftedsignal.io/briefs/2026-11-netapp-ontap-tools-cve-2023-28840/
Triage facts
Revision 1- Applicability
- ONTAP tools for VMware vSphere (< 10.5P2), Astra Control Provisioner
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 12, 16:25 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A vulnerability has been identified in NetApp ONTAP tools for VMware vSphere 10, identified as CVE-2023-28840. The flaw allows a remote attacker to cause a denial of service and negatively impact data integrity. NetApp has released a patch for the ONTAP tools suite, but explicitly stated that no fix is planned for the associated Astra Control Provisioner component.
Impact
Successful exploitation allows for remote denial of service and unauthorized modification of data integrity within the targeted management environment.
Recommendation
- Upgrade NetApp ONTAP tools for VMware vSphere 10 to version 10.5P2 or later to mitigate the vulnerability.
- For users of Astra Control Provisioner, acknowledge that no patch is available and review internal compensating controls, such as network isolation or restrictive access control lists, to limit exposure to this component.
Mitigations
Upgrade NetApp ONTAP tools for VMware vSphere 10 to 10.5P2 or later
CVE-2023-28840