Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Hitachi Vantara Remote Ops Agent lets unauthenticated users become admin

CVE-2026-108336 · published 3 days ago
Summary

The Remote Operations Agent uses a default security certificate to create the codes that prove a user is logged in. If that default certificate is left unchanged, a person on the network could create their own login codes and appear as an administrator, allowing them to change settings or request logs. Replace the default certificate with a unique, trusted one (or configure proper certificates) to stop this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hitachi vantara remot ops agent <= 2.0
Original advisory text
Token Signing Key Allows Unauthenticated Administrative Access
When the default self-signed certificate is used, an attacker could gain administrative access to the application.



The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login.



An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-321Use of Hard-coded Cryptographic Key
Timeline
Published14 Oct 2026
Updated16 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-108336 · NVD
CVE-2026-108336 · MITRE
Track software like this
Free during beta