IBM Operations Analytics – Log Analysis deploys default manufacturing passwords during installation. An attacker who discovers a newly installed instance can authenticate without resetting credentials, thereby gaining access to the application. The flaw is a default password bypass and is classified as CWE‑1392. The vulnerability may enable information disclosure; (Based on the description, the attacker could potentially view log data).

The vulnerability affects IBM Operations Analytics – Log Analysis versions from 1.3.2.0 through 1.3.8.4, as well as the specialized 1.3.7‑TIV‑IOALA‑FP‑signed release. Systems that have not changed the default passwords or have not integrated LDAP authentication are at risk.

The CVSS score of 8.4 indicates a high severity vulnerability, while the EPSS score of less than 1 % indicates a low probability of exploitation. (Based on the information, exploitation requires remote access to the installation interface; the attacker can log in with the default credentials). For environments where the installation interface is exposed to the Internet or a trusted network, the risk is elevated, even though the vulnerability is not listed in CISA’s KEV catalog.