EUVD-2026-72653
GHSA-6jc2-v95v-m7rh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network deserialization RCE with full impact, but AC:H because success depends on a reachable deserializing endpoint and a viable classpath gadget chain not confirmed for default configs.
Primary rating from Vendor (Hitachi).
CVSS VectorVendor: Hitachi
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.
AnalysisAI
Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CWE-502) across a broad range of 09-xx and 11-xx releases. Per the CVSS vector an unauthenticated remote attacker who can deliver a crafted serialized object to a vulnerable endpoint can achieve full confidentiality, integrity, and availability compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to a Cosminexus Component Container endpoint that deserializes attacker-supplied data, plus the presence of an exploitable gadget chain on the application classpath. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a maximally severe, network-reachable, unauthenticated flaw, and CWE-502 deserialization issues in Java application servers have a well-documented history of reliable RCE via public gadget chains, so the theoretical ceiling is high. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory (hitachi-sec-2026-130): upgrade to the corresponding fixed maintenance release for your branch - 11-70-03, 11-60-03, 11-20-10, 11-00-13, 09-87-10, 09-80-05, or 09-70-28; note that the 11-50, 11-40, 11-30, 11-10, 09-50, and 09-00 branches are listed 'through' their latest tested build, so operators on those lines should consult Hitachi to confirm the target upgrade path since a same-branch fix may not exist. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Hitachi Cosminexus Component Container and restrict network access to affected instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allow
OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cos
XML External Entity (XXE) injection in Hitachi Cosminexus Component Container allows unauthenticated remote attackers to
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today