Hitachi JP1 EUVD-2026-110652

The description states only that a heap-based buffer overflow affects specific version ranges of the listed JP1 products (JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent, and Agent Minimal Edition from 13-00 before 13-50-31; JP1/Base from 11-00 before 12-50-54) and names no feature, protocol, or configuration prerequisite. The CVSS vector AV:N/AC:L/PR:N/UI:N implies remote, unauthenticated, low-complexity exploitation reachable over the network without user interaction, but the specific service, port, or crafted input that triggers the overflow is not described in the available sources. The principal limiting factor is exposure: the affected JP1 service must be network-reachable by the attacker, and running a fixed version (13-50-31, or 12-50-54 for JP1/Base) removes the condition entirely. Authentication is not required per PR:N.

The CVSS 3.1 base score of 9.4 with vector AV:N/AC:L/PR:N/UI:N describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, which on paper is critical. However, the real-world signals temper this: EPSS is only 0.45% (39th percentile), indicating low modeled probability of exploitation in the near term, and there is no CISA KEV listing and no public exploit or PoC reference in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today priority is nonetheless 'act_now,' which conflicts with the low EPSS; this divergence most likely reflects the high CVSS plus the exposure of a network-facing enterprise management product rather than observed in-the-wild activity, so the act_now label should be read as severity/exposure-driven urgency, not evidence of active exploitation. Note the impact asymmetry: the vendor vector rates availability only A:L despite this being a heap overflow (CWE-122), a class that commonly yields crashes or code execution - the trigger and the precise impact are not described in the available sources, so whether memory corruption leads to reliable RCE cannot be confirmed from the data. Net: treat as a genuine high-priority patch item given network reach, no auth, and a vendor fix, but the absence of KEV/PoC and the low EPSS suggest this is not yet under opportunistic mass exploitation.

A remote, unauthenticated attacker with network access to an exposed JP1 management or agent service sends crafted input that overflows a heap buffer, corrupting memory to crash the service or potentially execute code in its context. No public exploit code or PoC is identified in the available data, so this scenario is inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:N) rather than a demonstrated technique; the exact triggering input is not described in the available sources.