Hitachi JP1/Automatic Job Management System 3 CVE-2026-76939

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation requiring no user interaction against the affected JP1/Automatic Job Management System 3 - Manager and Agent components in versions 11-00 before 13-50-31. The available sources do NOT describe the exact feature, protocol, configuration, or input that triggers the heap overflow, so no specific enabling configuration can be named. The primary limiting factor is version: deployments at 13-50-31 or later are fixed. Exposure also depends on whether the vulnerable Manager/Agent service is network-reachable to the attacker; a product of this type is typically deployed on internal management networks, which constrains reach in well-segmented environments, though no such limitation is stated in the advisory text provided.

Signals align toward genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction with full confidentiality, integrity and availability impact, and the vuln.today decision label is act_now with a vendor patch available. However, the signals are not uniform: the EPSS score is low at 0.52% (44th percentile), the CVE is NOT listed in CISA KEV, and no public exploit or PoC reference is present in the input. This means there is no evidence of active exploitation or available exploit code at time of analysis - the high rating is driven by the CVSS severity and act_now label, not by observed in-the-wild activity. The practical conclusion is that this is a legitimately high-severity, patch-now issue for anyone running the affected JP1/AJS3 components, but the current real-world exploitation pressure appears low; the 9.8 reflects worst-case potential rather than confirmed mass exploitation. The description provides no detail on how the heap overflow (CWE-122) is triggered, so the specific attack mechanism is not verifiable from the available sources.

A remote attacker sends crafted network input to an exposed JP1/AJS3 Manager or Agent service running a vulnerable version (11-00 before 13-50-31), triggering a heap-based buffer overflow. Because the CVSS vector indicates no authentication or user interaction is required and attack complexity is low, successful exploitation could corrupt heap memory to achieve code execution or service crash. No public exploit code or PoC reference is present in the provided data, and the exact trigger is not described in the available sources.