What is the CVSS score of EUVD-2026-32505?

EUVD-2026-32505 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of IBM Log Analysis are affected by EUVD-2026-32505?

IBM Operations Analytics and SmartCloud Analytics versions 1.3.2.0 through 1.3.8.4 contain hardcoded default credentials allowing attackers with local system access to gain full administrative…

How to fix or mitigate EUVD-2026-32505?

Within 24 hours: Inventory systems running Operations Analytics versions 1.3.2.0-1.3.8.4 and assess exposure to local or physical access. Within 7 days: Implement network segmentation isolating affected systems and restrict local access; disable non-critical instances if operationally feasible. Within 30 days: Monitor vendor advisories for patch availability; evaluate alternative log analysis solutions if patch release timeline is unclear.

IBM Log Analysis EUVD-2026-32505

| CVE-2026-7365 HIGH

Use of Default Credentials (CWE-1392)

2026-05-27 psirt@us.ibm.com

GHSA-9mxp-rq8m-qq98

Authentication Bypass IBM

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:15 vuln.today

DescriptionCVE.org

IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.

AnalysisAI

Authentication bypass in IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis (Operations Analytics versions 1.3.2.0 through 1.3.8.4) stems from hardcoded default credentials baked in during the manufacturing/installation process. An attacker who can reach the installation can authenticate with these known-default passwords, gaining full control with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector scores this as a local-vector issue (AV:L) rather than remote, no public exploit has been identified, and SSVC reports exploitation status of 'none'.

Technical ContextAI

The product is IBM's log analytics platform (Operations Analytics - Log Analysis, and its predecessor branding SmartCloud Analytics - Log Analysis), used for ingesting, indexing, and searching operational/machine log data. The root cause is classified as CWE-1392 (Use of Default Credentials): credentials provisioned during the manufacturing/build or install process are shipped or generated with predictable default values and are intended to be used only transiently during setup. When those defaults are not rotated or removed after installation, anyone who knows them (they are typically documented or recoverable from product artifacts) can authenticate as if they were a legitimately provisioned account, effectively bypassing the authentication boundary.

RemediationAI

Consult the IBM advisory at https://www.ibm.com/support/pages/node/7272268 for the official fix; no exact patched version number was present in the available data, so apply the vendor's prescribed update or interim fix for your affected release (Operations Analytics - Log Analysis 1.3.2.0 through 1.3.8.4). The immediate compensating action for a default-credential flaw is to change every default/installation password to a strong unique value and confirm no transient setup accounts remain active after installation completes - this directly removes the attack precondition with minimal side effects. Additionally, restrict local access to the Log Analysis host to trusted administrators only (the CVSS AV:L vector means limiting local/console and adjacent-host access materially reduces exposure), and audit authentication logs for logins using known default accounts; the trade-off is operational overhead in credential management and tighter host access controls. Do not assume absence of a published version means no fix exists - verify directly with IBM.