Hitachi HiRDB EUVD-2026-110664

The available sources do not describe the trigger: the description states only 'OS Command Injection Vulnerability in HiRDB' and does not name the exact injectable feature, protocol, SQL interface, or configuration setting required. Per the vendor-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N), the conditions implied are remote, unauthenticated exploitation requiring no user interaction against affected HiRDB Server builds - but the lack of a described mechanism means these conditions are the vendor's scoring claim, not independently verified. Limiting factors: exposure is bounded to the affected version ranges (HiRDB Server V10 10-00 before 10-12-01; V9 09-00 through 09-66-22; V9 Additional Function 09-00 through 09-66/V; V9(32) 09-02 through 09-66-22; V9(32) Additional Function 09-00 through 09-66-/V), to environments running Hitachi HiRDB (a niche RDBMS), and to deployments where the vulnerable interface is network-reachable; the vendor has published a patch, which is the remediation path indicated.

Signals are mixed. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) describes a maximally severe remote, unauthenticated, low-complexity OS command injection (CWE-78) with full confidentiality, integrity and availability impact. The vuln.today priority label is act_now and a vendor patch is available, which argues for prompt remediation. However, the exploitation-likelihood signals are more moderate: EPSS is 1.77% (78th percentile) - elevated but far from the near-certain range - and there is no CISA KEV listing (not confirmed actively exploited) and no public exploit reference in the supplied data (no public exploit identified at time of analysis). No SSVC exploitation/automatable/technical-impact decision values were provided beyond the act_now label. The key conflict to flag: the CVSS vector claims network, unauthenticated, low-complexity exploitation, but the one-line description ('OS Command Injection Vulnerability in HiRDB') does not describe the trigger, the injectable interface, or whether authentication is actually required - so the PR:N/AV:N claims rest entirely on the Hitachi/NVD scoring and are not independently verifiable from the description. Net: treat as a high-priority patch for HiRDB operators given the act_now label, maximal CVSS and available fix, while recognizing the real-world exploitation probability (EPSS, no KEV, no PoC) is currently moderate rather than confirmed-widespread.

Per the vendor CVSS vector, a remote attacker sends crafted input to an exposed HiRDB server interface that incorporates attacker-controlled data into an OS command, causing arbitrary commands to run on the database host with the server's privileges. No public exploit code was identified in the provided data, and the specific injectable interface is not described in the available sources. Because the scored vector is AC:L/PR:N/UI:N, no special timing, user interaction, or prior authentication is claimed to be required.