CVE-2026-108337
An administrator could retrieve the password reset code for any user and take over the account.
Published Oct 14, 2026 · updated Oct 14, 2026 · Hitachi Vantara Remot Ops Agent
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the
Affected
- vendor Hitachi Vantara Remot Ops Agentversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-108337
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An atta
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-108337
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An atta
cve.org - FIRST EPSSExploitation probabilityCVE-2026-108337
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2026-108337
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. A
nvd.nist.gov