IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
IBM Operations Analytics - Log Analysis affected
Version Status Constraints
1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3 affected ≤ 7.2.0.14
1.3.6.0, 1.3.6.1 affected —
1.3.7.0, 1.3.7.1, 1.3.7.2 affected —
1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Ibm Subscribe
Operations Analytics Log Analysis Subscribe
Advisories

No advisories yet.

Fixes

Solution

None

Workaround

Implement the LDAP user registry in place of the database-managed custom user registry provided in Log Analysis. Refer to the link below for more information: * Configuring LDAP authentication in IBM Operations Analytics for Log Analysis 1.3.7 https://www.ibm.com/docs/en/oala/1.3.7 * Configuring LDAP authentication in IBM Operations Analytics for Log Analysis 1.3.8 https://www.ibm.com/docs/en/oala/1.3.8

References
Link Providers
https://www.ibm.com/support/pages/node/7268536 cve-icon cve-icon
History

Wed, 27 May 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
Title IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism
First Time appeared Ibm
Ibm operations Analytics Log Analysis
Weaknesses CWE-521
CPEs cpe:2.3:a:ibm:operations_analytics___log_analysis:1.3.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operations_analytics___log_analysis:1.3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operations_analytics___log_analysis:1.3.7.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operations_analytics___log_analysis:1.3.8.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm operations Analytics Log Analysis
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-05-27T15:33:16.940Z

Reserved: 2024-07-08T19:30:52.530Z

Link: CVE-2024-40684

cve-icon Vulnrichment

Updated: 2026-05-27T15:33:13.786Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:16:40.757

Modified: 2026-05-27T14:53:51.833

Link: CVE-2024-40684

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T15:30:27Z

Weaknesses