Operations Analytics Log Analysis
Monthly
Authentication can be bypassed on IBM Operations Analytics - Log Analysis deployments that still carry the default passwords created during the manufacturing/installation process, giving an attacker access to the installation instead of being challenged at login. Per IBM's published vector the attacker needs local access to the host and low-level existing privileges (AV:L/PR:L), which materially limits reach; the sources do not confirm whether the affected login interface is network-exposed, and our own assessment scores the reachability as network/unauthenticated in the worst case. Technical impact is total if the default credentials are unrotated, but no public exploit has been identified at time of analysis, EPSS is 0.02% (5th percentile), and SSVC records exploitation as none and automatable as no, so this reads as serious-but-not-urgent and is tracked for remediation this week.
Authentication can be bypassed on IBM Operations Analytics - Log Analysis deployments that still carry the default passwords created during the manufacturing/installation process, giving an attacker access to the installation instead of being challenged at login. Per IBM's published vector the attacker needs local access to the host and low-level existing privileges (AV:L/PR:L), which materially limits reach; the sources do not confirm whether the affected login interface is network-exposed, and our own assessment scores the reachability as network/unauthenticated in the worst case. Technical impact is total if the default credentials are unrotated, but no public exploit has been identified at time of analysis, EPSS is 0.02% (5th percentile), and SSVC records exploitation as none and automatable as no, so this reads as serious-but-not-urgent and is tracked for remediation this week.