CVE-2026-108337
7.4HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-640
Impact
A malicious or compromised administrator can take over any other user account by retrieving their password reset codes. Exploitation requires network access and existing administrative privileges on the target Hitachi Vantara application.
Root cause
An admin-accessible API endpoint inadvertently exposes password reset codes for other users in its response output.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Check the Hitachi Vantara support portal advisory (solution ID 261012131624707) for the patched software release and apply it. In the interim, restrict administrative access to trusted operators and monitor admin API activity.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.