Read the docs
TI-2026-74510 Aliases CVE-2026-108335

Remote Ops Agent password reset lacks brute-force protection

Priority MEDIUM 47CWE-640Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

Hitachi Vantara Remote Ops Agent versions from 1.6.0 through 2.0 are affected. The password reset functionality has no rate limiting on attempts to enter the reset code, which enables brute-force attacks (CWE-640). When the password reset feature and email are configured, an unauthenticated remote attacker can take over any account and gain administrative access to the application, but device credentials and customer data cannot be accessed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Fix Fixed Remote Ops Agent (Hitachi Vantara): 2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hitachi VantaraRemote Ops Agent1.6.0 – 2.02.1Patch availableCNA
  • Remote Ops Agent VendorHitachi Vantara Affected 1.6.0 – 2.0 Fixed in 2.1 Patch available CNA

Remediation

Upgrade Hitachi Vantara Remote Ops Agent to version 2.1 or later, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Remote Ops Agent (Hitachi Vantara) Fixed in 2.1

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-108335
  2. 2026-10-15 CISA SSVC decision points changed

References

Other 1

  • TI-2022-21586 Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-21503 Injection in Hitachi Vantara Pentaho Business Analytics Server KEVCVSS 3.1HIGH 8.8
  • TI-2022-21585 Code injection in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1HIGH 8.8
  • TI-2022-21507 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource CVSS 3.1HIGH 8.8
  • TI-2022-21505 Path traversal in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1MEDIUM 6.5
  • TI-2026-74511 Default certificate key in Remot Ops Agent lets attackers bypass login CVSS 4.0CRITICAL 9.1
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences