EUVD-2026-72671
GHSA-g7wp-2w98-5323
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor vector adopted (unauthenticated network argument injection); description is too terse to independently downgrade impacts, so High C/I/A retained with the caveat noted above.
Primary rating from Vendor (Hitachi).
CVSS VectorVendor: Hitachi
Lifecycle Timeline
3DescriptionCVE.org
Command Argument Injection Vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 through 11-00-12, from 09-87 before 09-87-10, from 09-80 through 09-80-04, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.
AnalysisAI
Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allows remote attackers to inject additional arguments into an underlying command invocation, per the vendor CVSS vector enabling full compromise of confidentiality, integrity and availability. A very wide band of releases is affected, spanning the 09-00 through 11-70 trains. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the vendor CVSS vector the flaw is remotely reachable with no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N), affecting the Cosminexus Component Container tier on any listed 09-00 through 11-70 build below the fixed level. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) portrays a trivially exploitable, unauthenticated, network-reachable flaw with total impact - a top-priority profile on paper. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed maintenance release for your train as documented in Hitachi advisory hitachi-sec-2026-133 (https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-133/index.html): patched levels are 11-70-03, 11-60-03, 11-20-10, 09-87-10, and 09-70-28 for the trains listed with a 'before' boundary, and administrators on trains listed as 'through' (11-50-03, 11-40-03, 11-30-08, 11-10-11, 11-00-12, 09-80-04, 09-50-22, 09-00-18) should move to the vendor-designated fixed build or a supported newer train. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all systems running Hitachi Cosminexus middleware and identify which versions are deployed within the affected range (09-00 through 11-70). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cos
Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CW
XML External Entity (XXE) injection in Hitachi Cosminexus Component Container allows unauthenticated remote attackers to
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today