Default Certs in Hitachi Remot Ops Agent v2.0 Enable Critical CVE-2026-108336 Admin Takeover

Hitachi Vantara Remot Ops Agent versions up to 2.0 contain a critical security flaw that allows attackers to bypass authentication. The issue stems from the use of default self-signed certificates for signing web interface tokens, enabling unauthorized administrative access.

What happened

The National Vulnerability Database lists CVE-2026-108336 as a critical severity issue with a CVSS score of 9.1. The flaw involves the SSL certificate used for the web interface, which signs JWT access tokens to validate user login status. According to the NVD record, this weakness is categorized under CWE-321, indicating a cryptographic issue.

When the default self-signed certificate is active, an attacker can generate valid JWT tokens. This capability allows them to bypass the login process entirely. The vulnerability affects all versions of Hitachi Vantara Remot Ops Agent up to and including version 2.0. No newer versions are mentioned as affected in the source material.

Why it matters

An attacker exploiting this flaw can gain full administrative access to the application. They can perform actions such as configuring the service or requesting log collection. However, the source material states that device credentials and customer data cannot be accessed through this specific vulnerability.

The risk is significant because it allows remote administrative control without needing valid user credentials. This is particularly dangerous for systems exposed to untrusted networks. The ability to forge tokens means standard login protections are ineffective if the default certificate is in use.

What to watch

• Monitor for unauthorized configuration changes in Remot Ops Agent.
• Check logs for unexpected token generation or login bypass attempts.
• Verify that default self-signed certificates have been replaced.
• Watch for requests to collect logs from unknown sources.

Who needs to act first

Teams should prioritize systems exposed to external networks or untrusted internal segments. Check whether the default certificate is still in use on any instances. If so, replace it immediately with a trusted certificate. Test the change in a non-production environment first to ensure service continuity. Back up configurations before making changes. Monitor logs for signs of exploitation while remediation is underway. Ensure that all administrative actions are logged and reviewed.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Hitachi Vantara

• Replace the default self-signed SSL certificate with a trusted certificate.
• Verify that all Remot Ops Agent instances are running updated configurations.
• Monitor web interface logs for unusual token usage or login patterns.
• Restrict network access to the web interface to trusted IP ranges only.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Hitachi Vantara Remot Ops Agent are affected?

Versions up to 2.0 are affected by this vulnerability.

Can attackers access customer data through this flaw?

No, the source material states that device credentials and customer data cannot be accessed.

What is the CVSS score for CVE-2026-108336?

The CVSS score is 9.1, which is rated as Critical.