Vulnerability details
CVE-2026-108335
Hitachi Vantara Remote Ops Agent
Password Reset Functionality Missing Brute-Force Protection
CVSS 4.0
9.1Critical
Official description
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.1Critical | 4.0 | CVEProject cvelistV5 (CNA) (HITVAN) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Hitachi Vantara | Remote Ops Agent | 1.6.0 ≤ v ≤ 2.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-15
- Last updated
- 2026-10-15
- State
- Published
- Assigner (CNA)
- HITVAN
- Kolun priority
- 18 · Low
Exploit prediction (EPSS)
0.23%
Probability of exploitation in 30 days
15.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-640Weak Password Recovery Mechanism for Forgotten Password