CVE-2026-108336

Deferred Deferred - Pending Action

Default SSL Certificate JWT Bypass in Hitachi Vantara Product

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Hitachi Vantara

Description

When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108336

EUVD

EUVD-2026-101706

Affected Vendors & Products

Vendor	Product	Version / Range
Hitachi	Vantara	Remot Ops Agent 1.60

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves the use of a default self-signed SSL certificate in the application. Attackers can exploit this to sign JWT access tokens, bypassing login authentication and gaining administrative access to the application. This allows them to configure the service or request log collection but does not expose device credentials or customer data.

Detection Guidance

This vulnerability is tied to the use of a default self-signed SSL certificate that signs JWT tokens. Detection involves checking for the presence of default certificates and validating JWT token signing mechanisms. Inspect web interface certificates and JWT token generation processes for anomalies.

Impact Analysis

An attacker could gain administrative control over the application, allowing them to modify settings or retrieve logs. While sensitive data like device credentials or customer information remains protected, unauthorized administrative access could disrupt operations or lead to further exploitation.

Compliance Impact

This vulnerability allows an attacker to gain administrative access to the application by bypassing login through forged JWT tokens. This could lead to unauthorized configuration changes or log collection, potentially violating data integrity and access control requirements under GDPR and HIPAA.

Mitigation Strategies

Replace the default self-signed SSL certificate with a trusted certificate to prevent attackers from signing JWT access tokens and bypassing login.

Hi! I’m here to help you understand CVE-2026-108336. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70