EUVD-2026-100772
GHSA-p96p-xp5g-wcj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitTrigger application error condition
-
ExecutionRead exposed internal information
-
ImpactUse details for further reconnaissance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session on Hitachi Ops Center Administrator at low privilege (PR:L) and the ability to reach the management interface over the network (AV:N); no user interaction is needed. The limiting factors are the required valid (even if low-level) account and the fact that the outcome is confined to disclosure of internal application information (C:L) with no integrity or availability impact - the attacker cannot modify data or disrupt service through this flaw. The exact feature or error path that leaks the information is not specified in the vendor description, so defenders should assume it is reachable through normal authenticated use of the administrator console on versions before 11.0.9-01. |
| Impact | This is a low-to-moderate priority issue despite being a confirmed, patched vulnerability. The CVSS 3.1 base score of 4.3 (Medium) is consistent with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N: network-reachable and low-complexity, but requiring low-privilege authentication (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. This aligns with CWE-209 (information exposure through error messages / internal application information). There is no CISA KEV listing and no EPSS score supplied in the input, so no public probabilistic exploitation signal is available; no proof-of-concept is referenced either. No signals conflict here - a low-impact, authentication-gated information disclosure with no evidence of exploitation is a genuinely low real-world priority rather than an urgent threat. The main caveat is that the vendor description is terse ('Internal Application Information Exposure'), so the exact nature and sensitivity of the leaked information is not confirmed from available data; verify against the Hitachi advisory before deprioritizing in high-security storage environments. |
| Exploit ScenarioDerived | An authenticated low-privilege user of Hitachi Ops Center Administrator triggers or observes application error conditions that return internal application details (e.g., stack traces, internal paths, or configuration data). The disclosed information could aid reconnaissance for a follow-on attack but does not itself grant integrity or availability impact. No public exploit code is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authenticated, low-privilege users of Hitachi Ops Center Administrator running versions before 11.0.9-01 can cause the management console to return error output that exposes internal application information, giving an attacker useful reconnaissance detail about the underlying service. The flaw maps to CWE-209 (improper error handling) and carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning it is remotely reachable only with a valid low-level account, needs no user interaction, and results in limited confidentiality impact with no integrity or availability loss. Vendor-released patch: 11.0.9-01; no public exploit identified at time of analysis, and the issue is not a confirmed actively exploited (CISA KEV) vulnerability, so it should be treated as a low-to-moderate priority hardening item rather than an emergency.
RemediationAI
Vendor-released patch: upgrade Hitachi Ops Center Administrator to 11.0.9-01 or later, per the Hitachi advisory Hitachi-sec-2026-138 (https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-138/index.html), and verify the running build number after the update since the fix targets a specific release train. Because the defect requires only a valid low-privilege account, the most effective compensating control is network-level: restrict reachability to the Ops Center Administrator management interface to a dedicated administrative VLAN or jump host and block it from general user and internet-routed segments - the trade-off is that legitimate administrators must then work through that bastion, adding a hop and creating a single point of failure if the bastion is unavailable. In parallel, audit and trim accounts on the console so that no principal holds more than the entitlement it needs, and disable or remove dormant, shared, and service accounts; the trade-off is some operational friction for teams relying on shared credentials, but it directly shrinks the set of principals who satisfy the PR:L prerequisite. Until the upgrade is applied, treat the console as an information-leak channel and avoid exposing raw error output to third parties, and review console and reverse-proxy logs for repeated requests that provoke error responses, which may indicate probing of the vulnerable path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-209, Generation of Error Message Containing Sensitive Information: input or state is fed to the application in a way that triggers a verbose error, stack trace, or debug response, and that response is returned to the requester instead of a sanitized generic message. In Hitachi Ops Center Administrator, a web-based storage and operations management console, the affected code path sits on the management interface that is reachable over the network, so any principal who can authenticate - even at low privilege - can exercise it. The exposed content is described only as 'internal application information,' which in this class typically means internal paths, component names, library versions, configuration parameters, query or API structure, or similar implementation detail useful for mapping the environment and planning follow-on attacks; the vendor description does not identify the specific endpoint or error path. Because the impact vector is C:L with I:N/A:N, the flaw is a disclosure-only defect: it cannot alter administrator-configured data and cannot take the console down. CPE data (cpe:2.3:a:hitachi:hitachi_ops_center_administrator:*:*:*:*:*:*:*:*) confirms the affected artifact is the Administrator component of Hitachi Ops Center across all builds prior to 11.0.9-01, and EUVD-2026-100772 records the same single-machine-version range (0 < 11.0.9-01), so the affected population is bounded and enumerable.
Know when Hitachi Ops Center Administrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable management interface (AV:N) with low complexity, but a valid low-privilege account is required (PR:L); impact is limited information disclosure only, so C:L and I:A:N.
Primary rating from Vendor (Hitachi).
CVSS VectorVendor: Hitachi
Lifecycle Timeline
1DescriptionCVE.org
Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator.
This issue affects Hitachi Ops Center Administrator: before 11.0.9-01.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB