Hitachi HiRDB CVE-2026-82116

Exploitation requires network reachability to an affected HiRDB Server instance (HiRDB Server Version 10 before 10-12-01; Version 9 and Version 9(32) and the 'with Additional Function' variants within the listed 09-xx ranges). Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or non-default configuration is indicated as required - the flaw is that a critical function is exposed without an authentication check (CWE-306). The specific function, protocol, or configuration setting that exposes it is not described in the available sources, so it cannot be confirmed whether a particular deployment mode or listener must be enabled. The primary practical limiting factor is network exposure: HiRDB is an enterprise database typically deployed on internal/back-end networks, so realistic risk is highest where the server port is reachable by untrusted clients and lower where it is segmented behind access controls.

Multiple signals point in the same direction for severity but diverge on real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a remotely reachable, unauthenticated, low-complexity flaw with full confidentiality, integrity and availability impact - consistent with CWE-306 (Missing Authentication for Critical Function), where a sensitive database operation is exposed without an authentication check. The vuln.today decision label is 'act_now', which should drive prioritization. However, the EPSS score is only 0.61% (49th percentile), there is no CISA KEV listing, and no public exploit or PoC reference appears in the input - so there is currently no evidence of active or imminent widespread exploitation. The tension to flag explicitly: a 9.8 CVSS with an 'act_now' label contrasts with a middling EPSS and no observed exploitation, meaning this is a genuinely high-severity flaw whose exploitation is plausible but not yet demonstrated in the wild. Mitigating the raw network vector, HiRDB is a Hitachi enterprise database typically deployed on internal/back-end networks rather than exposed to the internet, so realistic exposure depends heavily on whether the affected service is network-reachable by an attacker. Treat as high priority for patching on exposed or segmented-but-reachable instances; the absence of KEV/PoC means it is urgent-to-patch but not an active-incident scenario at time of analysis.

An attacker with network access to a HiRDB server instance reaches the critical function that lacks an authentication check and invokes it directly without supplying credentials, obtaining read/write access to or control over the database. Given AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required once the service is reachable. No public exploit code or PoC is identified at time of analysis, so exploitation would require an attacker to independently develop the request against the exposed function.