Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Hitachi Vantara Remote Ops Agent password reset can be brute‑forced

CVE-2026-108335 · published 3 days ago
Summary

The password reset feature in Remote Ops Agent does not limit how quickly someone can try different reset codes. This allows an attacker to keep guessing codes until they succeed and take over an account, potentially gaining admin rights. Turn off the reset function if not needed or add a limit on attempts to stop rapid guessing.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hitachi vantara remote ops agent <= 2.0
Original advisory text
Password Reset Functionality Missing Brute-Force Protection
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.



There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.



An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-640Weak Password Recovery Mechanism for Forgotten Password
Timeline
Published14 Oct 2026
Updated16 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-108335 · NVD
CVE-2026-108335 · MITRE
Track software like this
Free during beta