Hitachi Coding Software EUVD-2026-90494

Exploitation requires network reachability to the critical API exposed by Hitachi Coding Software Suite version 3.3.0 or earlier; no authentication, credentials, or user interaction are needed (PR:N/UI:N/AC:L). The limiting factor is exposure and prevalence rather than attacker effort: the vulnerable API endpoint must be network-accessible to the attacker, and the product is specialized industrial coding software typically deployed on operational/manufacturing networks rather than the public internet, which constrains realistic reach. No specific non-default configuration is named in the advisory; the flaw is the absence of an authentication check on a critical function.

The CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a genuinely severe profile on paper: an unauthenticated, network-reachable, low-complexity missing-authentication flaw (CWE-306) that exposes full confidentiality, integrity, and availability of the affected system. All exploitation-likelihood signals, however, are either absent or dampening. No EPSS score is provided, the CVE is not in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The single reference is Hitachi's own vendor advisory (self-report), meaning the technical impact wording ('potentially leading to unauthorized retrieval or alteration') is the vendor's and has not been independently corroborated. The key tension is between a maximal CVSS vector and a very narrow real-world footprint: Hitachi Coding Software Suite is specialized industrial marking/coding software, not broadly internet-exposed enterprise software, so the practical blast radius is far smaller than a 9.3 suggests. This is best treated as a high-severity-but-low-current-threat issue: patch promptly where deployed (especially if the API is network-reachable), but it is not an indiscriminate mass-exploitation priority absent POC/KEV data.

An attacker with network access to a host running Hitachi Coding Software Suite (≤3.3.0) directly calls an exposed critical API endpoint that performs no authentication check. Because no credentials, user interaction, or special conditions are required (AV:N/AC:L/PR:N/UI:N), the attacker reads or modifies sensitive configuration/operational data or manipulates the coding system's functions. No public exploit code is currently identified, so exploitation would require the attacker to discover and craft the unauthenticated API request themselves.