JP1/AJMS3 Manager CVE-2026-76937

Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no special configuration, authentication, or user interaction is stated to be required: the flaw is in JP1/Automatic Job Management System 3 - Manager versions from 10-00 before 13-50-31, reachable over the network against the Manager component. Limiting factors: exploitation requires network reachability to the JP1/AJMS3 Manager service (typically an internal enterprise management host, not internet-exposed), and the affected scope is bounded to Manager builds older than 13-50-31 - hosts on 13-50-31 or later are not affected. The exact trigger is not described in the available sources, so the AC:L/PR:N claims could not be independently verified.

Signals are moderately aligned toward prioritization but with one notable tension. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact (score 9.4), and the input carries an 'act_now' decision label with a patch available from Hitachi. Against that, EPSS is only 0.45% (39th percentile), which is low and indicates no strong statistical signal of imminent broad exploitation. There is no CISA KEV listing and no public exploit referenced, so active exploitation is not confirmed. The honest reading: this is a genuinely high-severity, easily-triggerable vulnerability class (heap buffer overflow) in enterprise job-management software, and the vendor/priority-feed treats it as act_now, but the low EPSS and absence of KEV/POC suggest exploitation is not yet widespread - consistent with a product that has a limited, enterprise-specific deployment footprint rather than an internet-wide target. The CVSS vector and heap-overflow CWE are consistent with each other; the main caveat is that the description does not state the trigger mechanism, so the AC:L and PR:N claims cannot be independently verified from the available sources.

A remote attacker sends crafted input over the network to the JP1/AJMS3 Manager service, overflowing a heap buffer to corrupt memory and influence process execution, leading to disclosure or modification of managed job data and potentially code execution in the Manager context. No public exploit code is referenced, and the specific trigger (which protocol/field) is not described in the available sources. The CVSS vector indicates this would require no authentication and no user interaction if the vector is accurate.