CVE-2026-108335
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.
Published Oct 14, 2026 · updated Oct 15, 2026 · Hitachi Vantara Remote Ops Agent
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the
Oct 15, 2026 · NIST NVD
Updated
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the
Affected
- vendor Hitachi Vantara Remote Ops Agentversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-108335
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password r
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-108335
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password r
cve.org - FIRST EPSSExploitation probabilityCVE-2026-108335
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2026-108335
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the passwor
nvd.nist.gov