Hitachi Disk Array Driver CVE-2026-86573

Exploitation requires pre-existing high-privilege local access (PR:H, AV:L) on a host running the vulnerable Hitachi Disk Array Driver - specifically IBM AIX (versions 01-00 up to but not including 01-23-/A) or a Hitachi Disk Array Driver for Virtual I/O Server (versions 01-04 up to but not including 01-23-/A) attached to Hitachi disk array storage. No user interaction is needed once that access is held (UI:N). The decisive limiting factors are the mandatory elevated privilege level and local-only vector: there is no network-facing exposure and no path for an unauthenticated or low-privilege actor, so realistic risk is confined to already-privileged operators or an attacker who has first compromised a privileged account. Deployments not using the Hitachi disk array driver, or already upgraded to 01-23-/A, are not exposed.

This is a genuinely low-to-moderate priority issue rather than an urgent one, and the signals are largely consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) describes a local, high-privilege attack: the adversary must already have elevated access on the AIX or Virtual I/O Server host before the out-of-bounds write (CWE-787) can be triggered, which sharply limits the realistic attacker population. Primary impact is to availability (A:H - likely a driver/kernel crash or system hang) with only limited integrity impact (I:L) and no confidentiality impact (C:N). There is no EPSS score provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No signals conflict here: a modest 5.1 score, local-only vector, and high-privilege prerequisite all point to a defense-in-depth patch rather than an emergency. The main caveats are missing data - EPSS and POC status are simply absent from the input (absence is not confirmation of low risk), and the required privilege level means the chief danger is an already-privileged or malicious insider/compromised account escalating to a denial of service against a storage I/O path.

An attacker who already holds high privileges on an AIX host or Virtual I/O Server (for example via a compromised root/admin account or a malicious operator) issues a crafted operation to the Hitachi Disk Array Driver that overflows a buffer, triggering an out-of-bounds write. The resulting memory corruption crashes or destabilizes the storage driver, denying disk I/O to the host. No public exploit code is referenced, and the local, high-privilege requirement makes opportunistic remote exploitation infeasible.