Hitachi JP1/AJS3 CVE-2026-76934

The fixed version is 13-50-31 for all branches; affected are JP1/AJS3 - Manager and - Agent (from 10-00/11-00 per source, before 13-50-31) and JP1/AJS3 - Agent Minimal Edition (11-50 before 13-50-31). The CVSS vector indicates remote, low-complexity exploitation with no authentication (PR:N) and no user interaction against the affected JP1/AJS3 services, but the available sources do not describe the exact feature, protocol, message, or network port that triggers the stack overflow, so the precise prerequisite cannot be stated. The practical limiting factor is network reachability: JP1/AJS3 Manager and Agent are internal job-management components typically deployed on segmented operations networks rather than internet-facing, which constrains exposure; whether any non-default configuration is required is not stated in the sources.

Severity signals and exploitation signals diverge here and the gap should drive prioritization. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing a network-reachable, low-complexity flaw needing no privileges or user interaction and yielding full confidentiality, integrity and availability loss - consistent with a stack-based buffer overflow (CWE-121) leading to remote code execution. Against that, the EPSS score is only 0.52% (44th percentile), indicating a low modeled probability of exploitation in the near term, and there is no CISA KEV listing and no public exploit or PoC reference in the supplied data, so exploitation status is: no public exploit identified at time of analysis. The vuln.today Decision label is act_now, which - together with the maximal CVSS and a vendor-supplied patch - makes this a remediate-now item despite the modest EPSS; the low EPSS most plausibly reflects that JP1/AJS3 is an internal enterprise scheduler with limited external attack surface and no weaponized code yet, not that the flaw is low-impact. Importantly, the supplied sources do not describe how the overflow is triggered (which component, port, protocol or message), so the real-world reachability of the network vector cannot be independently confirmed from this data and should be verified against Hitachi advisory hitachi-sec-2026-140. In short: treat as a genuine high priority because of the act_now decision and critical RCE profile, while recognizing the low EPSS and absent public exploit mean this is not yet observed mass exploitation.

An attacker with network reachability to an exposed JP1/AJS3 Manager or Agent service sends a crafted oversized input that overflows a stack buffer in the affected component, corrupting the stack to achieve remote code execution with the privileges of the JP1 service. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is indicated as required, though the specific trigger is not described in the available sources. No public exploit or PoC has been identified at time of analysis.