Read the docs
TI-2026-74512 Aliases CVE-2026-108337

Password Reset Code Exposed in Remot Ops Agent User Listing API

Priority LOW 34CWE-640Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

Hitachi Vantara Remot Ops Agent versions 1.6.0 through 2.0 include password reset codes in the output of a user listing API. An administrator can retrieve the reset code for any user and use it to reset that user's password and take over the account. The API is restricted to administrator accounts, so an attacker needs existing administrative access, and device credentials and customer data cannot be reached through this flaw. CVSS 4.0 rates it 7.4 (HIGH), and CISA has not added it to KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00282 20th percentileScored 2026-11-07
Fix Fixed Remot Ops Agent (Hitachi Vantara): 2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hitachi VantaraRemot Ops Agent1.6.0 – 2.02.1Patch availableCNA
  • Remot Ops Agent VendorHitachi Vantara Affected 1.6.0 – 2.0 Fixed in 2.1 Patch available CNA

Remediation

Update Remot Ops Agent to version 2.1, which fixes the issue. No workaround is documented, so restrict administrator accounts to the people who need them until the update is applied.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Remot Ops Agent (Hitachi Vantara) Fixed in 2.1

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-108337
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-18 CISA SSVC decision points changed

References

Other 1

  • TI-2022-21586 Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-21503 Injection in Hitachi Vantara Pentaho Business Analytics Server KEVCVSS 3.1HIGH 8.8
  • TI-2022-21585 Code injection in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1HIGH 8.8
  • TI-2022-21507 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource CVSS 3.1HIGH 8.8
  • TI-2022-21505 Path traversal in Hitachi Vantara Pentaho Business Analytics Server CVSS 3.1MEDIUM 6.5
  • TI-2026-74511 Default certificate key in Remot Ops Agent lets attackers bypass login CVSS 4.0CRITICAL 9.1
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences