Hitachi HiRDB CVE-2026-82117

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special access is required - exploitation is remote and unauthenticated against a reachable HiRDB Server instance. The limiting factor is network exposure: the attacker must be able to reach the HiRDB service, so instances restricted to internal/segmented networks or behind firewalls are substantially harder to reach, and exposure is confined to the enumerated versions (HiRDB Server v10 10-00 before 10-12-01; v9 and v9(32) and the 'with Additional Function' variants 09-00/09-02 through the 09-66 branches). The specific configuration or protocol condition that enables the spoofing is not described in the available sources and should be confirmed with Hitachi.

Signals are mixed but lean toward prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a remotely reachable, unauthenticated authentication bypass with full confidentiality, integrity and availability impact - severe on paper. The vuln.today priority is act_now and a vendor patch is available, which argues for urgent remediation. However, the EPSS score is low at 0.64% (51st percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present in the supplied data, so there is currently no evidence of active or imminent widespread exploitation. The tension is between a maximal CVSS/act_now signal and a modest EPSS with no observed exploitation; this is consistent with a genuinely dangerous flaw in a product that is not broadly internet-exposed, meaning risk is high for the organizations that run HiRDB but not a mass-exploitation event. The description states only 'Authentication Bypass by Spoofing' and does not explain the trigger mechanism, so the precise attack technique cannot be confirmed from available sources and should be verified against the Hitachi advisory.

An attacker with network reachability to an exposed HiRDB server spoofs or forges authentication material to bypass identity verification (CWE-290) and connect as a trusted/privileged database user without valid credentials. Once authenticated, the attacker can read, modify, and destroy database contents, yielding full compromise of the data tier. No public exploit or PoC is identified in the available data, and the exact spoofing trigger is not described in the sources.