Brute Force Vulnerability in Hitachi Vantara's Password Reset Functionality

CVE-2026-108335

What is CVE-2026-108335?

The Hitachi Vantara application contains a vulnerability in its password reset functionality. When the reset feature is enabled and email services are configured, malicious actors can exploit this weakness by executing a brute-force attack to gain unauthorized account access. The lack of rate limiting on reset code attempts permits an attacker to systematically try multiple codes, potentially compromising user accounts. Although this vulnerability does not allow access to device credentials or customer data, it can enable administrative level access, allowing further manipulation of application settings or log retrieval.

References