What is the CVSS score of CVE-2026-82122?

CVE-2026-82122 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-82122?

Within 24 hours, identify all internet-facing HiRDB Server instances and restrict network access to trusted sources where possible. Within 7 days, apply the vendor-released fixed versions: Version 10 must be upgraded to 10-12-01 or later; Version 9 branches (including 9(32) and Additional Function variants) must be upgraded to 09-66-23 or later (or 09-66/V1 or later for the V variant). If immediate patching is infeasible, implement network segmentation and monitoring for anomalous activity. Within 30 days, verify patch deployment across all environments, conduct a security review of database access controls, and ensure logging and alerting are in place to detect exploitation attempts.

HiRDB Server CVE-2026-82122

Q: Which versions of HiRDB Server are affected by CVE-2026-82122?

A critical stack-based buffer overflow in Hitachi HiRDB Server puts sensitive database services at risk of remote code execution by unauthenticated attackers.. A patch is available.

EUVD-2026-110662 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-10-27 Hitachi

GHSA-gqg7-qhr5-2xm4

Buffer Overflow Stack Overflow Hirdb Server Version 10 Hirdb Server Version 9 Hirdb Server With Additional Function Version 9 Hirdb Server Version 9 32 Hirdb Server With Additional Function Version 9 32

9.4

CVSS 3.1 · Vendor: Hitachi

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach exposed HiRDB Server over network
Delivery

Send crafted oversized input
Exploit

Overflow fixed-size stack buffer
Execution

Corrupt stack / control flow
Impact

Compromise data confidentiality and integrity

Vulnerability Assessment

Weakness	CWE CWE-121 ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special configuration is stated as required - the flaw is reachable by remote attackers against an affected HiRDB Server reachable over the network. The available sources do NOT describe which protocol, request, or feature triggers the overflow, so the exact exposed surface is unconfirmed. The main practical limiter is reachability: HiRDB Servers are typically deployed on internal/back-end database tiers, so exploitation depends on an attacker having a network path to the server; exposure is confined to the listed versions (Version 10 before 10-12-01, and Version 9 branches including the 9(32) and Additional Function variants through 09-66-22 / 09-66/V).
Impact	Signals conflict on urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact (base 9.4), and the vuln.today decision label is 'act_now' with a vendor-supplied patch available - both pointing to prompt remediation. Against that, the EPSS score is low at 0.45% (39th percentile), there is no CISA KEV listing, and no public PoC or exploit reference is supplied, so there is currently no evidence of exploitation activity. The practical read is a genuinely high-severity, easily-reachable bug whose real-world exploitation has not yet materialized - prioritize patching because of the unauthenticated network vector and critical impact, not because of observed attacks. One notable tension: a stack-based buffer overflow (CWE-121) usually threatens availability through crashes, yet the vendor vector rates availability only A:L while giving C:H/I:H; the description does not state the trigger mechanism, so the exact impact profile should be confirmed with the Hitachi advisory.
Exploit ScenarioDerived	A remote attacker with network reach to an exposed HiRDB Server sends crafted input that overflows a fixed-size stack buffer in the server, corrupting the stack to disclose or alter data and potentially gain control of execution. No authentication or user interaction is required per the CVSS vector. The precise trigger is not described in the available sources, and no public exploit code is identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 28, 2026

Stack-based buffer overflow in Hitachi HiRDB Server allows remote, unauthenticated attackers to corrupt memory and potentially execute code, with high confidentiality and integrity impact. The affected ranges are Version 10 from 10-00 before 10-12-01 and Version 9 branches - including 9(32) and Additional Function variants - from 09-00/09-02 through 09-66-22 or 09-66/V. Hitachi has released fixed versions; EPSS is 0.45% (39th percentile), no public exploit was identified at time of analysis, and vuln.today priority guidance is act_now despite the conflicting urgency signals noted in the independent assessment.

RemediationAI

Vendor-released patch: HiRDB Server Version 10 is fixed in 10-12-01, so installations from 10-00 through pre-10-12-01 builds must be upgraded to 10-12-01 or later. For the Version 9 branches - HiRDB Server Version 9 (09-00 through 09-66-22), HiRDB Server with Additional Function Version 9 (09-00 through 09-66/V), HiRDB Server Version 9(32) (09-02 through 09-66-22), and HiRDB Server with Additional Function Version 9(32) (09-00 through 09-66-/V) - apply the fixed build designated in Hitachi advisory hitachi-sec-2026-144, since the affected ranges end at those builds. The advisory is at https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-144/index.html; no specific workaround is described in the available sources, so the vendor update is the remediation indicated.

Affected VersionsENISA

HiRDB Server with Additional Function Version 9 09-00 ≤09-66/V

HiRDB Server Version 9 09-00 ≤09-66-22

HiRDB Server Version 9(32) 09-02 ≤09-66-22

HiRDB Server with Additional Function Version 9(32) 09-00 ≤09-66-/V

HiRDB Server Version 10 10-00 <10-12-01

Affected Packages

euvd hirdb_server_version_10 fix: 10-12-01

euvd hirdb_server_version_9 no fix

euvd hirdb_server_version_9_32 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

HiRDB is Hitachi's relational database management system used for mission-critical and OLTP workloads. CVE-2026-82122 is CWE-121, a stack-based buffer overflow: data is written beyond the bounds of a fixed-size buffer allocated on the stack, which can overwrite adjacent stack memory such as saved return addresses or control data. The available sources do not describe the specific protocol, request, or feature that triggers the overflow, so the trigger is not described in the available sources and the exact exposed surface remains unconfirmed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network without authentication, user interaction, or special configuration, with network reachability to the database server being the main practical limiter. CPE entries cover hirdb_server_version_10, hirdb_server_version_9, hirdb_server_with_additional_function_version_9, hirdb_server_version_9(32), and hirdb_server_with_additional_function_version_9(32).

Know when Hirdb Server Version 10 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Hitachi) PRIMARY 9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

vuln.today AI 9.8 CRITICAL

Vendor vector supports AV:N/AC:L/PR:N/UI:N; a stack overflow (CWE-121) realistically crashes the server, so A:H rather than the vendor's A:L, though the trigger is undescribed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Hitachi).

CVSS VectorVendor: Hitachi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Oct 27, 2026 - 10:01 EUVD

CVE Published

Oct 27, 2026 - 09:37 cve.org

CRITICAL 9.4

DescriptionCVE.org

Stack-based Buffer Overflow Vulnerability in HiRDB.

This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.

Executive ViewAI

Why It Matters

A critical stack-based buffer overflow in Hitachi HiRDB Server puts sensitive database services at risk of remote code execution by unauthenticated attackers. This affects organizations relying on HiRDB for core database operations, potentially exposing confidential data and compromising data integrity. Leadership should prioritize immediate remediation due to the high potential for business disruption and data breach.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Prevalence

Low

Niche Hitachi enterprise RDBMS, concentrated in Japanese market deployments

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +47

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.