What is the CVSS score of CVE-2026-82121?

CVE-2026-82121 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-82121?

Within 24 hours, identify all systems running affected versions of Hitachi HiRDB Server (versions 10 before 10-12-01, 9 through 09-66-22, 9 with Additional Function through 09-66/V, 9(32) through 09-66-22, and 9(32) with Additional Function through 09-66-/V) and assess exposure to untrusted networks. Within 7 days, apply the vendor-released patch by upgrading to version 10-12-01 (or later) for version 10, and to version 09-66-22 (or later) for version 9, including additional function variants as per vendor guidance. Within 30 days, verify patch deployment across all instances, conduct a security review of network access controls for HiRDB servers, and monitor for any unusual data access patterns.

Hitachi HiRDB CVE-2026-82121

Q: Which versions of Hitachi HiRDB are affected by CVE-2026-82121?

Hitachi HiRDB Server contains a high-severity information disclosure vulnerability (CVE-2026-82121) that remote, unauthenticated attackers can exploit over the network.. A patch is available.

EUVD-2026-110663 HIGH

Origin Validation Error (CWE-346)

2026-10-27 Hitachi

GHSA-8792-5gpx-5fx8

Information Disclosure Hirdb Server Version 10 Hirdb Server Version 9 Hirdb Server With Additional Function Version 9 Hirdb Server Version 9 32 Hirdb Server With Additional Function Version 9 32

7.5

CVSS 3.1 · Vendor: Hitachi

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach HiRDB server over network
Exploit

Send request with spoofed/unvalidated origin
Execution

Bypass origin validation (CWE-346)
Impact

Server returns confidential data

Vulnerability Assessment

Weakness	CWE CWE-346 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Origin validation
Exploitation Conditions	The available description ('Origin Validation Error Vulnerability in HiRDB') does not state the exact feature, protocol, or configuration that triggers the flaw, so the precise precondition is not described in the sources. Per the supplied CVSS vector the issue is rated remotely reachable and unauthenticated with no user interaction against the affected HiRDB Server builds, but this cannot be mapped to a concrete configuration from the text. Limiting factors: exploitation requires network reachability to the HiRDB Server, and only the listed version ranges are affected - HiRDB Server Version 10 (10-00 before 10-12-01); HiRDB Server Version 9 (09-00 through 09-66-22); HiRDB Server with Additional Function Version 9 (09-00 through 09-66/V); HiRDB Server Version 9(32) (09-02 through 09-66-22); HiRDB Server with Additional Function Version 9(32) (09-00 through 09-66-/V). The vendor patch (HiRDB Server Version 10 fixed at 10-12-01) is the remediation indicated by the advisory.
Impact	The input CVSS (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability impact - consistent with an origin-validation (CWE-346) information-disclosure issue. The real-world signals, however, pull toward lower urgency: EPSS is only 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is provided. The vuln.today decision label is 'this_week' rather than act_now/emergency, which aligns with a patchable but non-emergency issue. This is therefore a genuinely severe-on-paper (HIGH) confidentiality flaw whose practical priority is tempered by a very low exploitation probability and the fact that HiRDB is a comparatively niche, Japan-centric enterprise database. Note the data gaps: the description does not explain how the origin-validation error is triggered, so the AV:N/AC:L/PR:N/UI:N rating cannot be independently corroborated from the mechanism - verify exploitation preconditions with the Hitachi advisory.
Exploit ScenarioDerived	A remote attacker able to reach the HiRDB server over the network sends traffic that is accepted because the server fails to properly validate the origin/source of the request, causing it to disclose confidential data it should not return to that party. Per the CVSS vector this requires no authentication and no user interaction, but the specific trigger is not described in the available sources. No public exploit or PoC has been identified.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 28, 2026

Information disclosure in Hitachi HiRDB Server can be triggered by remote, unauthenticated attackers over the network, with high confidentiality impact and no integrity or availability impact (CVSS 7.5). The flaw is classified as an origin validation error (CWE-346) and affects HiRDB Server Version 10 before 10-12-01, HiRDB Server Version 9 through 09-66-22, HiRDB Server with Additional Function Version 9 through 09-66/V, HiRDB Server Version 9(32) through 09-66-22, and HiRDB Server with Additional Function Version 9(32) through 09-66-/V. EPSS is low at 0.21% (10th percentile), there is no CISA KEV confirmation, and no public exploit was identified at time of analysis; the vendor has released a patch.

RemediationAI

Apply the vendor-released patch: HiRDB Server Version 10 is fixed at 10-12-01 and later, per the Hitachi advisory at https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-145/index.html. The provided data does not list a specific fixed release for the Version 9 branches (HiRDB Server Version 9, HiRDB Server with Additional Function Version 9, HiRDB Server Version 9(32), and HiRDB Server with Additional Function Version 9(32)), so consult that advisory for the applicable Version 9 update before upgrading. Because exploitation requires network reachability to the HiRDB Server, a compensating control pending upgrade is to restrict network access to affected instances to trusted clients only; the trade-off is reduced connectivity for legitimate consumers of the database service.

Affected VersionsENISA

HiRDB Server Version 9 09-00 ≤09-66-22

HiRDB Server Version 10 10-00 <10-12-01

HiRDB Server with Additional Function Version 9(32) 09-00 ≤09-66-/V

HiRDB Server Version 9(32) 09-02 ≤09-66-22

HiRDB Server with Additional Function Version 9 09-00 ≤09-66/V

Affected Packages

euvd hirdb_server_version_10 fix: 10-12-01

euvd hirdb_server_version_9 no fix

euvd hirdb_server_version_9_32 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

HiRDB is Hitachi's relational database management system, and the affected CPE entries map to five distinct server product families: HiRDB Server Version 10, HiRDB Server Version 9, HiRDB Server with Additional Function Version 9, HiRDB Server Version 9(32), and HiRDB Server with Additional Function Version 9(32). The root cause class is CWE-346, Origin Validation Error, meaning the software fails to correctly validate the origin of a request or data before acting on it; in a database server context this class typically leads to exposure of information to an entity that should not receive it. The provided sources do not describe the exact feature, protocol, listener, or configuration that triggers the flaw, so the specific validation gap and attack path remain unverified beyond the CWE classification and the assessed CVSS vector. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates the issue is network-reachable, low-complexity, and requires no privileges or user interaction, with impact limited to confidentiality.

Know when Hirdb Server Version 10 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Hitachi) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Origin-validation error reachable over the network without authentication or interaction yields confidentiality disclosure only; no integrity or availability impact, so I:N/A:N and S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Hitachi).

CVSS VectorVendor: Hitachi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Oct 27, 2026 - 10:01 EUVD

CVE Published

Oct 27, 2026 - 09:37 cve.org

HIGH 7.5

DescriptionCVE.org

Origin Validation Error Vulnerability in HiRDB.

This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.

Executive ViewAI

Why It Matters

Hitachi HiRDB Server contains a high-severity information disclosure vulnerability (CVE-2026-82121) that remote, unauthenticated attackers can exploit over the network. This could allow unauthorized access to sensitive database contents, affecting the confidentiality of business data and potentially leading to compliance and reputational damage. Leadership should prioritize patching all affected HiRDB instances to prevent potential data leaks.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

Low

Hitachi HiRDB is a niche, largely Japan-centric enterprise database

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.