CVE-2026-108335: Remote Ops Agent 1.6.0 through 2.0

Affected technology

Remote Ops Agent · 1.6.0 through 2.0
Hitachi Vantara

Component: Web Interface

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says when the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. Vendor/CNA’s CVSS 4.0 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none.