Read the docs
TI-2026-74511 Aliases CVE-2026-108336

Default certificate key in Remot Ops Agent lets attackers bypass login

Priority MEDIUM 47CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

Hitachi Vantara Remot Ops Agent versions from 1.60 through 2.0 are affected. The default self-signed certificate's key is used to sign the JWT access tokens that validate logins, which is a hard-coded cryptographic key (CWE-321). A remote unauthenticated attacker can sign their own tokens and gain administrative access to the application, but device credentials and customer data cannot be accessed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00223 12th percentileScored 2026-11-08
Fix Fixed Remot Ops Agent (Hitachi Vantara): 2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hitachi VantaraRemot Ops Agent1.60 – 2.02.1Patch availableCNA
  • Remot Ops Agent VendorHitachi Vantara Affected 1.60 – 2.0 Fixed in 2.1 Patch available CNA

Remediation

Upgrade Hitachi Vantara Remot Ops Agent to version 2.1, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Remot Ops Agent (Hitachi Vantara) Fixed in 2.1

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-108336
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-16 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2022-21586 Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-21503 Injection in Hitachi Vantara Pentaho Business Analytics Server KEVCVSS 3.1HIGH 8.8
  • TI-2022-21585 Code injection in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1HIGH 8.8
  • TI-2022-21507 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource CVSS 3.1HIGH 8.8
  • TI-2022-21505 Path traversal in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1MEDIUM 6.5
  • TI-2026-74510 Remote Ops Agent password reset lacks brute-force protection CVSS 4.0CRITICAL 9.1
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences