EUVD-2026-100774
GHSA-c2w5-vf7f-hrgh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged account
-
ExploitPre-create/symlink predictable temp file
-
ExecutionPrivileged user triggers driver operation
-
ImpactCorrupt files and disrupt driver (integrity/availability)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Secure temp file creation
|
| Exploitation Conditions | Requires a local authenticated account (PR:L) on an AIX system running Hitachi Disk Array Driver for AIX (01-00 before 01-23-/A) or on a Virtual I/O Server running Hitachi Disk Array Driver for Virtual I/O Server (01-04 before 01-23-/A), where the driver creates an insecure/predictable temporary file (CWE-377). Exploitation additionally requires user interaction (UI:R) - a higher-privileged user or process must execute the driver operation that handles the insecure temp file, giving the attacker the window to win the symlink/pre-creation race. Limiting factors: no remote exploitation (AV:L), the attacker must already possess a local account, and success depends on the privileged action occurring and the attacker winning the race, which constrains reliability. |
| Impact | The vendor CVSS of 7.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H) is driven almost entirely by the scope change (S:C) combined with high integrity and availability impact - not by ease of access. The attack vector is LOCAL (AV:L), requires an existing low-privileged account (PR:L), AND requires user interaction (UI:R), which collectively make opportunistic or remote exploitation impossible. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of local-only vector, required privileges, required user interaction, and a niche enterprise storage product (IBM AIX / Virtual I/O Server) means real-world risk is materially lower than the 7.9 'High' label suggests - this is a defense-in-depth / insider-and-shared-host concern rather than an urgent internet-facing emergency. Note one conflicting signal: the input Tags include 'Information Disclosure', yet the CVSS vector specifies C:N (no confidentiality impact), so the information-disclosure characterization is inconsistent with the authoritative vector - verify with the Hitachi advisory. |
| Exploit ScenarioDerived | A local, low-privileged user on an AIX host or Virtual I/O Server pre-creates or symlinks a predictable temporary file used by the Hitachi Disk Array Driver (CWE-377). When a higher-privileged process or administrator subsequently runs the driver operation (the required user interaction), the attacker redirects or tampers with the temp file to overwrite or corrupt files outside the driver's own component, damaging integrity and availability. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Hitachi Disk Array Driver for AIX (01-00 before 01-23-/A) and for Virtual I/O Server (01-04 before 01-23-/A) mishandle temporary files (CWE-377), allowing a locally authenticated attacker to pre-create or symlink a predictable temp file path and redirect a higher-privileged driver operation, yielding high integrity and availability impact with an assessed scope change (S:C) and a vendor CVSS of 7.9. Exploitation is strictly local (AV:L) and requires user interaction (UI:R) - a privileged user or process must trigger the driver operation while the attacker wins the race - so no public exploit has been identified at time of analysis and there is no KEV/active-exploitation signal. The practical risk is a local privilege-escalation-style attack against AIX and VIOS hosts with the affected driver installed, degrading to tampering/availability loss rather than confidentiality exposure (C:N).
RemediationAI
Vendor-released patch: upgrade Hitachi Disk Array Driver for AIX to 01-23-/A or later and Hitachi Disk Array Driver for Virtual I/O Server to 01-23-/A or later, following the Hitachi advisory at https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-137/index.html; because the driver operates in privileged I/O and array-management paths, schedule the upgrade in a maintenance window and reboot the AIX host or VIOS partition as the vendor instructions require, since a partial driver-level upgrade may leave the vulnerable temp-file routine loaded. If immediate upgrade is not possible, compensating controls are limited and each carries a trade-off: reduce the number of local accounts on the affected AIX/VIOS systems and restrict interactive shell access (PR:L is a prerequisite), accepting the operational burden of shared admin accounts; harden temporary-file handling by mounting a per-user or restricted filesystem over the temp path the driver uses or setting restrictive permissions (e.g., 1777 with sticky bit plus monitoring, or non-world-writable TMPDIR where the driver honors it) and auditing for pre-existing files or symlinks owned by non-root in /tmp and /var/tmp, with the trade-off that this can break other applications relying on the same temp path; and enable AIX/VIOS auditing for the driver's temp-file creation and for unexpected symlink activity in temp directories, accepting the added log volume and the fact that detection, not prevention, is achieved. If the array driver is not in use on a host, removing or not installing the package is the cleanest risk elimination.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-377, Insecure Temporary File: the driver creates a temporary file in a world-accessible location (commonly /tmp or /var/tmp) using a predictable name and without secure creation semantics such as O_CREAT|O_EXCL or mkstemp(), and without adequate permission/ownership checks before use. Because the filename is guessable, a local attacker with PR:L can pre-create the path or plant a symbolic link pointing to a privileged target; when the driver's privileged operation later opens or writes the file (the UI:R trigger), the write follows the attacker-controlled link, corrupting or substituting data with the driver's elevated privileges. The scope change in the assessed vector (S:C) reflects that the impact crosses from the attacking user's security context into the driver/VIOS privilege domain, with high integrity (I:H) and availability (A:H) impact when backed by array management or I/O paths, but no confidentiality (C:N) impact since no data is read back to the attacker. The affected components are the AIX device driver package (cpe:2.3:a:hitachi:hitachi_disk_array_driver_for_aix) and the Virtual I/O Server package (cpe:2.3:a:hitachi:hitachi_disk_array_driver_for_virtual/i/o_server), where VIOS is a privileged AIX-based partition whose compromise affects every client LPAR sharing its virtual storage, making the S:C penalty more consequential in practice.
Know when Hitachi Disk Array Driver For Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
Insecure temp-file race is exploitable only by a local low-privileged user (AV:L/PR:L) and needs a privileged action to occur (UI:R); it tampers with files beyond the driver (S:C, I:H/A:H) with no data disclosure (C:N).
Primary rating from Vendor (Hitachi).
CVSS VectorVendor: Hitachi
Lifecycle Timeline
2DescriptionCVE.org
Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.
This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A.
Executive ViewAI
Hitachi's Disk Array Driver for AIX (01-00 before 01-23-/A) and for Virtual I/O Server (01-04 before 01-23-/A) mishandle temporary files, letting a local user redirect a higher-privileged driver operation and thereby tamper with or disrupt storage-driver behavior on affected hosts. Because AIX and VIOS systems typically underpin core enterprise storage and virtualization workloads, unpatched instances represent a concentration risk even though the attack requires local access, user interaction, and a successful race condition. No vendor patch is currently available and no public exploit has been identified, so leadership attention should focus on inventorying exposed hosts and applying interim hardening while a fix is pending.
No vendor-released patch identified at time of analysis. Interim mitigations: inventory and isolate affected AIX and VIOS hosts; restrict local interactive access and local accounts to the minimum necessary; enforce least privilege for any user or process able to trigger driver operations; harden filesystem and temporary-directory permissions to prevent untrusted pre-creation or symlinking of predictable temp file paths; monitor driver temp paths for anomalous file creation or redirection attempts; and engage Hitachi support for a supported workaround or accelerated fix timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB