CVE-2024-40684 is a medium severity (5.9) flaw in IBM Operations Analytics Log Analysis 1.3.5.0 through 1.3.8.4. The product does not enforce strong passwords by default. IBM lists no fix and recommends using an LDAP user registry in place of the product's database managed registry.
What's affected
IBM lists these releases: 1.3.5.0 to 1.3.5.3, 1.3.6.0 and 1.3.6.1, 1.3.7.0 to 1.3.7.2, and 1.3.8.0 to 1.3.8.4. The bulletin names no fixed version and its remediation section says none.
The issue is a missing password strength requirement by default. The CVSS vector is AV:N/AC:H/PR:N/UI:N, with high confidentiality impact and no integrity or availability impact. The high attack complexity reflects that an attacker has to guess or crack passwords.
How to check if you're exposed
Check your version and how users are managed.
- Log in to the Log Analysis administration pages and read the version. Compare it with the list above.
- Check whether users are created in the product's own database registry or come from LDAP.
- Review the existing user list for short passwords, shared accounts and accounts that have not been used for a long time.
- Check whether the login page is reachable from outside your management network.
What to do now
- Confirm your version and registry type.
- Follow IBM's recommendation and configure an LDAP user registry. IBM provides guides for 1.3.7 and 1.3.8. The bulletin does not link guides for 1.3.5 or 1.3.6, so check IBM documentation for those.
- Make sure the LDAP directory enforces your password policy and lockout rules.
- Disable or delete local database accounts once users are migrated.
- Restrict network access to the product and add multi factor authentication in front of it where you can.
Why it matters
The weakness is CWE-521, weak password requirements. It is not a code defect that an attacker exploits with a single request. It is a missing control that makes guessing and credential stuffing practical.
Log platforms collect data from many systems, including tokens and personal data that appear in log lines. Access to a log store is often a good source for further attacks, so the accounts that guard it deserve the same password rules as other privileged systems.
Quick check
Why does IBM recommend LDAP?
Because the LDAP directory can enforce your organization's password policy, which the product's database registry does not do by default.
Sources
Last reviewed: 19 October 2026.
