Hitachi JP1/AJS3 Manager CVE-2026-76938

The attacker must have network access to the JP1/Automatic Job Management System 3 - Manager service on an affected version (10-00 up to but not including 13-50-31); per CVSS PR:N/UI:N the exploit is unauthenticated and requires no user interaction. The specific feature, protocol, or configuration that enables the authentication bypass is not described in the available sources - the Hitachi advisory (hitachi-sec-2026-142) must be consulted for exact conditions. The main limiting factor is network exposure: JP1/AJS3 Manager is typically an internal management server, so risk is greatest where the management interface is reachable from untrusted networks; patched build 13-50-31 and later are not affected.

This is a genuine high-priority issue rather than a high-CVSS paper tiger, and the signals largely agree. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated bypass with high confidentiality, integrity, and availability impact - consistent with CWE-290 (authentication bypass by spoofing) and the act_now priority label from vuln.today. A vendor patch is confirmed available from Hitachi. The tension in the data is the EPSS score: at 0.64% (51st percentile) it is modest and does not reflect the near-worst-case CVSS, which indicates no observed mass-exploitation activity yet rather than low danger - EPSS lags for freshly disclosed enterprise software with no public exploit. This vulnerability is NOT in CISA KEV and no public exploit or PoC reference was supplied, so active exploitation is not established. The description is extremely sparse ('Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3') and does not state the bypass mechanism, so the specific trigger is not described in the available sources; the Hitachi advisory (hitachi-sec-2026-142) should be consulted for the exact affected component and conditions.

A remote attacker with network access to an exposed JP1/AJS3 - Manager instance (versions 10-00 before 13-50-31) bypasses authentication to gain unauthorized control over the central job-management server without valid credentials or user interaction. Because JP1/AJS3 Manager orchestrates scheduled jobs across managed hosts, such access could allow an attacker to view, alter, or disrupt automated enterprise workflows. No public exploit or PoC was identified at time of analysis, and the exact bypass trigger is not described in the available sources.