Description
IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
Published: 2026-05-27
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in IBM Operations Analytics – Log Analysis allows attackers to compromise accounts because the software does not enforce strong password policies by default. This weakness (CWE‑521) means that weak or guessable passwords can be used to log in, giving attackers full access to the application and underlying data, potentially exposing sensitive information and compromising system integrity and availability.

Affected Systems

Affected versions are IBM Operations Analytics – Log Analysis 1.3.5.0 through 1.3.8.4. The vulnerability applies to the local user registry stored in the database; all installations using these releases are susceptible.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no current exploitation activity. The likely attack vector is through the application’s login interface: an attacker can use a weak password to authenticate and gain unauthorized access. Because no patch is available, the risk remains unless mitigated.

Generated by OpenCVE AI on May 27, 2026 at 15:21 UTC.

Remediation

Vendor Solution

None

Vendor Workaround

Implement the LDAP user registry in place of the database-managed custom user registry provided in Log Analysis. Refer to the link below for more information: * Configuring LDAP authentication in IBM Operations Analytics for Log Analysis 1.3.7 https://www.ibm.com/docs/en/oala/1.3.7 * Configuring LDAP authentication in IBM Operations Analytics for Log Analysis 1.3.8 https://www.ibm.com/docs/en/oala/1.3.8

OpenCVE Recommended Actions

  • Configure LDAP authentication as described in IBM’s ‘Configuring LDAP authentication in IBM Operations Analytics for Log Analysis 1.3.7’ and ‘1.3.8’ guides to replace the database‑managed user registry and enforce stronger password policies.
  • For any remaining local accounts, enforce an organization‑wide strong password policy and set an account lockout threshold.
  • Audit and disable unused or orphaned local user accounts to reduce the attack surface.

Generated by OpenCVE AI on May 27, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
Title IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism
First Time appeared Ibm
Ibm operations Analytics Log Analysis
Weaknesses CWE-521
CPEs cpe:2.3:a:ibm:operations_analytics___log_analysis:1.3.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operations_analytics___log_analysis:1.3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operations_analytics___log_analysis:1.3.7.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operations_analytics___log_analysis:1.3.8.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm operations Analytics Log Analysis
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Ibm Operations Analytics Log Analysis
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-05-27T13:48:59.081Z

Reserved: 2024-07-08T19:30:52.530Z

Link: CVE-2024-40684

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:16:40.757

Modified: 2026-05-27T14:53:51.833

Link: CVE-2024-40684

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T15:30:27Z

Weaknesses