Hitachi Vantara application CVE-2026-108335

Exploitation requires that the application's password-reset functionality is enabled AND email delivery is configured - without both, the reset-code challenge cannot be initiated. The core flaw is the absence of rate limiting on reset-code entry attempts (CWE-640), allowing unlimited automated guessing. Limiting factors: the attack is bounded to administrative application functions (service configuration, log collection requests) and cannot reach device credentials or customer data per the vendor; it also depends on the reset feature being active, which is a deployment-specific prerequisite rather than a guaranteed default. No user interaction or prior authentication is needed (PR:N/UI:N), but AT:P reflects the need for the enabled reset flow plus repeated brute-force attempts.

The CVSS 4.0 base score of 9.1 (Critical) is driven by network attack vector (AV:N), low complexity (AC:L), no required privileges (PR:N) or user interaction (UI:N), and high confidentiality and integrity impact (VC:H/VI:H) via administrative account takeover. The one moderating signal in the vendor's own vector is AT:P (Attack Requirements: Present), reflecting that the brute-force requires the password-reset feature to be enabled and email to be configured, plus a potentially large number of guessing attempts. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a high-severity, config-dependent weakness rather than a confirmed in-the-wild threat. The score is credible: a missing rate limit on a password-reset code (CWE-640) is a genuinely automatable auth bypass. However, note two tempering factors stated by the vendor itself: the scope is bounded (administrative functions like service configuration and log collection) and explicitly excludes device credentials and customer data, which caps real-world blast radius below what a 9.1 might suggest. The input Tag 'Information Disclosure' conflicts with the description, which states data cannot be accessed - treat that label as inaccurate (see data_quality_flags).

An attacker who knows or guesses a valid account identifier triggers the password-reset flow and receives the challenge to enter a reset code. Because there is no rate limiting on code-entry attempts, the attacker scripts an automated brute-force against the reset code space and, on success, sets a new password to take over the account - potentially an administrator. No public exploit code is identified in the provided data, but the technique is straightforward to automate given network access and the enabled reset feature.