EUVD-2026-72656
GHSA-84vf-8fgj-wv3v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor vector is internally consistent with an unauthenticated network-reachable OS command injection yielding full host impact; AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H are retained absent evidence of auth or config gating.
Primary rating from Vendor (Hitachi).
CVSS VectorVendor: Hitachi
Lifecycle Timeline
3DescriptionCVE.org
OS command injection vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.
AnalysisAI
OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cosminexus/uCosminexus Application Server - allows remote attackers to inject and execute arbitrary operating-system commands (CWE-78). The flaw spans a broad set of legacy and current branches from 09-00 through 11-70 and carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, implying unauthenticated network reachability with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions are required - network-reachable, unauthenticated exploitation without user interaction against affected builds of Hitachi Cosminexus Component Container (versions from 09-00 through 11-70 as listed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely one-directional and severe: the vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes an unauthenticated, low-complexity, network-reachable command injection with total system impact - the archetype of a high-priority flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed per-branch release identified in Hitachi advisory hitachi-sec-2026-132 (https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-132/index.html): the version boundaries in the affected list imply patched builds at or above 11-70-03, 11-60-03, 11-20-10, 11-00-13, 09-87-10, 09-80-05, and 09-70-28 for those branches, and operators on 11-50/11-40/11-30/11-10/09-50/09-00 branches (which show 'through' the latest listed patch level) should confirm the fixed level directly with Hitachi since a released fix version for those lines is not explicitly enumerated in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct rapid inventory of all Cosminexus Application Server instances across production, development, and staging environments and map their network accessibility and data criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allow
Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CW
XML External Entity (XXE) injection in Hitachi Cosminexus Component Container allows unauthenticated remote attackers to
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today