EUVD-2026-72655
GHSA-44fm-q5rc-wxj2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Network-reachable XXE with no auth; AC:H for application-specific XML intake condition; C:H for file disclosure, A:H for entity-expansion DoS, I:N as XXE yields reads not writes.
Primary rating from Vendor (Hitachi).
CVSS VectorVendor: Hitachi
Lifecycle Timeline
3DescriptionCVE.org
Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.
AnalysisAI
XML External Entity (XXE) injection in Hitachi Cosminexus Component Container allows unauthenticated remote attackers to disclose sensitive local files or cause a denial of service through maliciously crafted XML input. The vulnerability spans an extensive range of versions across the 09-xx through 11-xx release trains, indicating a long-lived parser misconfiguration in the middleware's XML processing subsystem. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a network-accessible endpoint hosted within the Cosminexus Component Container accepts and parses XML input from an attacker-controlled source without pre-filtering DOCTYPE declarations or external entity references. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H scores 7.4 (High), with AC:H indicating that exploitation requires specific conditions-likely that the container must accept and process XML from an untrusted network source, which depends on how applications deployed within it are structured. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the patched version for your release train: 11-70-03 or later (11-70 branch); 11-60-03 or later (11-60 branch); 11-20-10 or later (11-20 branch); 11-00-13 or later (11-00 branch); 09-87-10 or later (09-87 branch); 09-80-05 or later (09-80 branch); 09-70-28 or later (09-70 branch). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cosminexus deployments and classify each by release train (09-xx, 10-xx, 11-xx) and maintenance status (active vs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allow
OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cos
Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CW
Share
External POC / Exploit Code
Leaving vuln.today