Hitachi Vantara Remote Ops Agent: Authentication bypass via default certificate
Summary
The web interface of Hitachi Vantara Remote Ops Agent uses its SSL certificate to sign JWT access tokens that prove a user is logged in. If the default self-signed certificate is still in use, an attacker can forge valid tokens and bypass the login without authentication or user interaction. This gives administrative access to the agent, which allows changing the service configuration and requesting log collection. Device credentials and customer data are reported as not accessible.
Affected
- Remote Ops Agent 1.60 to 2.0 (with the default self-signed certificate)
- Version 2.1 is listed as unaffected
- Installations with a replaced certificate are not affected by this issue, according to the CVE record
Fixed in
- Remote Ops Agent 2.1 (per the CVE record text; the vendor advisory could not be verified)
Workaround
- Replace the default self-signed certificate of the web interface with a different certificate
- Restrict network access to the management interface to trusted hosts until the upgrade is done (recommendation from a third-party tracker)
Exploitation
- No public proof of concept or exploitation in the wild found at the time of research
- Not listed in CISA KEV at the time of the snapshot
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total
- VulDB reports no known exploit (third-party statement, may be outdated)
Our recommendation
- Inventory all Remote Ops Agent instances and their versions
- Check whether the web interface still uses the default certificate and replace it if so
- Restrict access to the management interface to trusted hosts, and never expose it to the internet
- Upgrade to version 2.1 after confirming the fix against the vendor advisory
- Monitor logs of the agent for unexpected administrative actions
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Hitachi Vantara advisory (access denied during research) knowledge.hitachivantara.com
- OpenCVE: CVE-2026-108336 app.opencve.io
- ionix threat center: CVE-2026-108336 www.ionix.io
- VulDB: vuln 420400 vuldb.com
- OffSeq Radar: CVE-2026-108336 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:34.
Original description (NVD)
When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.