IBM Log Analysis CVE-2026-7365

Exploitation requires that the default passwords provisioned during the installation/manufacturing process were never changed to unique values on the deployed instance; an attacker then uses those known default credentials to bypass authentication. Per IBM's CVSS the attacker must have local access to the host (AV:L) and some low-level existing privilege (PR:L), which materially limits reach compared with a remote unauthenticated flaw - this is the key limiting factor defenders should weigh. The description does not state whether the affected login is network-exposed, so network reachability cannot be confirmed from the available sources. Affected versions span 1.3.2.0, 1.3.3.0, 1.3.5.0-1.3.5.3, 1.3.6.0-1.3.6.1, 1.3.7.0-1.3.7.2, and 1.3.8.0-1.3.8.4 (per EUVD/CPE).

Signals point to a genuinely high technical impact but a low real-world exploitation likelihood, so this reads as a serious-but-not-urgent issue rather than an active threat. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total compromise of confidentiality, integrity, and availability once reached, and SSVC agrees on Technical Impact: total. However, SSVC also records Exploitation: none and Automatable: no, EPSS is only 0.02% (5th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is provided - only the IBM vendor advisory. Exploitation status is therefore: no public exploit identified at time of analysis. One conflict to verify with the vendor: the description frames this as an authentication bypass via default credentials, which usually implies a network-reachable login, yet IBM's own vector is AV:L (local) with PR:L (authenticated/low-privilege) - the local vector materially lowers real-world reach, so confirm with IBM whether the affected login/installation interface is network-exposed. The vuln.today priority of 'this_week' aligns with patching in the normal cycle rather than treating it as an emergency.

An attacker who already has local, low-privilege access to a host running IBM Operations Analytics / SmartCloud Analytics - Log Analysis uses a known default password left over from the manufacturing/installation process to bypass authentication and obtain full control of the component. Because the credentials are factory defaults, no exploit development is needed once the attacker reaches the interface, though per IBM's CVSS the attacker needs local access (AV:L) and low existing privileges (PR:L). No public PoC or exploit code is identified at time of analysis.