CVE-2026-108335: Password Reset Functionality Missing Brute-Force Protection
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.
There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.
An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Remote Ops Agentto a version that resolves this vulnerability.Fixed in 2.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when password reset functionality is enabled and email is configured. The provided information does not identify affected product versions or configurations beyond those conditions.
What does an attacker need to exploit it?
An attacker needs the ability to repeatedly submit password reset codes for a target account. The issue is caused by the absence of rate limiting on reset-code entry attempts.
What could an attacker do after a successful account takeover?
A successful attacker could gain administrative access to the application and perform actions such as configuring the service or requesting log collection. The vulnerability does not provide access to device credentials or customer data.