CVE-2026-108335 json
Password Reset Functionality Missing Brute-Force Protection
published 2026-10-14 25 d ago modified 2026-10-16 23 d ago also EUVD-2026-101705
- cvss
- 9.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.
There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.
An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Patch / fix
- Hitachi Vantara Remote Ops Agent 2.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 24 d ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Hitachi Vantara Remote Ops Agent
Classification
- Weakness
-
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
References
Sources
- CVE List CVE-2026-108335
- NVD CVE-2026-108335
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.