Hitachi JP1 CVE-2026-86575

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are stated - remote unauthenticated exploitation with low attack complexity against the affected JP1 components. The practical limiting factors are: the vulnerable listener/service must be network-reachable from the attacker (JP1 manager/agent components are typically deployed on internal operations networks rather than internet-facing, which constrains real-world exposure), and only the specified versions are affected - JP1/Integrated Management 3 - Manager, JP1/AJS3 - Manager, JP1/AJS3 - Agent, and JP1/AJS3 - Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. The exact trigger (which component, port, protocol, or message) is not described in the available sources, so the specific feature or input that must be reachable cannot be named from the provided data.

The CVSS 3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact - a severe memory-corruption bug (CWE-121, stack-based buffer overflow) in widely-deployed Hitachi JP1 operations-management components. These severity signals conflict with the exploitation signals: EPSS is only 0.45% (39th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or imminent widespread exploitation. The vuln.today Decision label is act_now, which - combined with the unauthenticated network vector and the fact that JP1/Base and JP1/AJS3 agents run broadly across managed hosts - justifies prioritized remediation despite the low EPSS; the low probability most plausibly reflects the product's niche global footprint and the absence of public exploit code rather than low exploitability. Note the inconsistency to resolve with the vendor: the vector rates A:L (low availability impact), which is atypical for a network-triggerable stack overflow where process crash or code execution is the usual outcome - verify the true availability impact against Hitachi's advisory. Net: a genuine high-priority patch item for JP1 operators, especially where affected services are network-exposed, but not currently an actively-exploited emergency based on the available exploitation data.

An attacker with network reachability to an affected JP1 component (e.g. a JP1/Base or JP1/AJS3 agent/manager listener) sends a crafted oversized input that overflows a stack buffer, corrupting memory to achieve code execution or crash the service - the CVSS AV:N/AC:L/PR:N/UI:N vector indicates this requires no authentication, user interaction, or special conditions. No public exploit code has been identified at time of analysis. The specific trigger (which message, field, or service) is not described in the available sources.