Hitachi Vantara UI CVE-2026-108336

Exploitation is possible ONLY when the web interface still uses the shipped default self-signed SSL certificate, because that certificate's key is reused to sign the JWT access tokens that authenticate sessions (CWE-321). This is reflected by the CVSS 4.0 AT:P metric. The primary limiting factor is deployment configuration: any environment that has replaced the default certificate with a custom/CA-issued certificate is not vulnerable, as the signing key would then be unknown to the attacker. No user interaction or prior authentication is required (PR:N/UI:N). Impact is further bounded - the attacker obtains administrative/configuration control (e.g., changing service settings, requesting log collection) but, per the vendor, cannot access device credentials or customer data.

This is a genuine high-priority issue rather than a CVSS-inflated one, but its exploitability is gated by a single configuration precondition. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H/VA:N, score 9.1) describes a remote, unauthenticated authentication bypass with high confidentiality and integrity impact but no availability impact - consistent with CWE-321 (use of a hard-coded/shared cryptographic key), since the default self-signed SSL certificate acts as a predictable signing key for JWT access tokens. The AT:P (Attack Requirements: Present) metric is the critical nuance: exploitation only works while the product still uses its shipped default self-signed certificate, so any deployment that replaced the certificate with a custom CA-issued one is not affected. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV and has no public exploit code referenced, so there is no evidence of active or at-scale exploitation. The impact is also self-limited by the vendor's own statement that device credentials and customer data cannot be reached - the attacker gains administrative/configuration control, not direct data exfiltration, which tempers the VC:H rating somewhat. Net: credible and serious for organizations running default certificates, but the single-condition gate plus absence of exploitation signals places it below actively-exploited internet-facing flaws in triage order.

An organization deploys the Hitachi Vantara web interface without replacing the shipped default self-signed SSL certificate. Because that certificate's key also signs the JWT access tokens, a remote attacker who possesses or derives the predictable default key forges a valid admin JWT and bypasses login entirely, then reconfigures the service or triggers log collection. No public exploit code is referenced at time of analysis, and exploitation requires the default certificate to still be in place (CVSS AT:P).