Hitachi Coding Suite EUVD-2026-90492

Exploitation requires network reachability to the Hitachi Coding Software Suite instance (through version 3.3.0) that exposes the JWT/Bearer-token-authenticated API. The only real prerequisite beyond network access is possession of the hard-coded JWT signing secret, which is shared across all installations and recoverable from the distributed software, so no victim credentials, user interaction, or special non-default configuration are needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is exposure: the affected product is niche industrial software, so the attacker must be able to reach its management/API endpoint, which in typical OT deployments may be network-segmented rather than internet-facing.

All available signals point to a genuinely high-severity, high-priority issue rather than an inflated CVSS score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a remotely reachable, low-complexity flaw requiring no authentication and no user interaction, with high impact to confidentiality, integrity, and availability - consistent with CWE-321 (Use of Hard-coded Cryptographic Key), where a static JWT signing secret lets anyone forge valid Bearer tokens. The 9.3 score is credible: a hardcoded signing key is a deterministic, reliably reproducible defect, not a probabilistic memory bug. However, no EPSS probability, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization at this time - the risk is currently theoretical-but-serious rather than observed-in-the-wild. The main mitigating factor is prevalence: Hitachi Coding Software Suite is niche industrial coding/marking (printer/coder) software, so exploitation is likely to be targeted (OT/industrial attacker reaching a management interface) rather than opportunistic internet-scale scanning. SSVC fields were not supplied and cannot be inferred. Net: treat as a high priority to patch for any organization running this product, while recognizing exploitation signals (EPSS/KEV/POC) are absent, suggesting targeted rather than widespread exploitation.

An attacker who has recovered the hard-coded JWT signing secret (e.g., by extracting it from the distributed software binaries) crafts a self-signed Bearer token asserting administrative identity and submits it to the application's API. Because the server validates tokens against the static, universally shared secret, the forged token is accepted and the attacker invokes administrative functions without any credentials. No public exploit code was identified at time of analysis, but the technique is trivially reproducible once the secret is known.