Hirdb Server With Additional Function Version 9 32
Monthly
Authentication bypass in Hitachi HiRDB Server (CWE-290, spoofing) lets a remote attacker who can reach the database service impersonate a trusted party and slip past authentication, with maximum impact on confidentiality, integrity and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). All five listed build lines are affected: Server Version 10 (10-00 before 10-12-01), Version 9 and Version 9(32) plus their 'with Additional Function' variants across the 09-00/09-02 to 09-66 branches. Exploitation is unauthenticated and needs no user interaction, so real-world risk is governed mainly by whether the HiRDB listener is reachable from untrusted networks; EPSS is low at 0.64% (51st percentile) and no public exploit has been identified at time of analysis, but the vendor has published a fix and the case is triaged act_now, so exposure should be checked rather than assumed benign.
Unauthenticated network attackers can invoke a critical HiRDB Server function without an authentication check, exposing affected Hitachi HiRDB Version 10 and Version 9-family deployments to high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is CWE-306 and is reachable over the network with no privileges or user interaction; Hitachi reports a vendor patch and the vuln.today decision is act_now, while EPSS is 0.61% (49th percentile). No CISA KEV status is provided, and no public exploit identified at time of analysis; Version 10 is fixed in 10-12-01, while the supplied data does not name fixed builds for the Version 9, Version 9(32), or 'with Additional Function' branches.
Stack-based buffer overflow in Hitachi HiRDB Server can corrupt memory and, per the supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8), is scored as remotely reachable by an unauthenticated attacker with no user interaction, yielding high confidentiality, integrity and availability impact. Affected builds are HiRDB Server Version 10 (10-00 before 10-12-01), Version 9 (09-00 through 09-66-22), Version 9 with Additional Function (09-00 through 09-66/V), Version 9(32) (09-02 through 09-66-22) and Version 9(32) with Additional Function (09-00 through 09-66-/V); EPSS is low at 0.52% (44th percentile) and no public exploit has been identified at time of analysis, although the vuln.today decision label is act_now and Hitachi has published an advisory with a vendor patch available.
Heap-based buffer overflow in Hitachi HiRDB Server affects Version 10 builds from 10-00 before 10-12-01 and multiple Version 9 branches (09-00 through 09-66-22, and the Additional Function and 9(32) variants through 09-66/V), allowing a remote, unauthenticated attacker who can reach the database service to corrupt heap memory with high impact on confidentiality, integrity and availability (CVSS 9.8). No public exploit code was identified at time of analysis and EPSS is low at 0.52% (44th percentile), so the exploitability signal is weak even though severity is critical. The priority label is act_now, driven by the maximum-severity network-reachable overflow rather than by observed exploitation, and Hitachi has released updated builds.
OS command injection in Hitachi HiRDB Server (Version 10 builds from 10-00 before 10-12-01, and Version 9 / Version 9 Additional Function / Version 9(32) / Version 9(32) Additional Function builds from 09-00 through the various 09-66-xx releases) could let an attacker run arbitrary operating-system commands under the database server's privileges; Hitachi's own CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), i.e. remote and unauthenticated with no user interaction, although the specific injectable interface or trigger is not described in the available sources. Signals are mixed: severity and vendor priority are high (vuln.today decision label act_now, EPSS 1.77% at the 78th percentile, indicating above-average but not top-tier predicted exploitation likelihood), yet no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Affected organizations are those running the listed Hitachi HiRDB enterprise RDBMS builds where the vulnerable interface is network-reachable; Hitachi has released fixes in its advisory hitachi-sec-2026-146.
Information disclosure in Hitachi HiRDB Server can be triggered by remote, unauthenticated attackers over the network, with high confidentiality impact and no integrity or availability impact (CVSS 7.5). The flaw is classified as an origin validation error (CWE-346) and affects HiRDB Server Version 10 before 10-12-01, HiRDB Server Version 9 through 09-66-22, HiRDB Server with Additional Function Version 9 through 09-66/V, HiRDB Server Version 9(32) through 09-66-22, and HiRDB Server with Additional Function Version 9(32) through 09-66-/V. EPSS is low at 0.21% (10th percentile), there is no CISA KEV confirmation, and no public exploit was identified at time of analysis; the vendor has released a patch.
Stack-based buffer overflow in Hitachi HiRDB Server allows remote, unauthenticated attackers to corrupt memory and potentially execute code, with high confidentiality and integrity impact. The affected ranges are Version 10 from 10-00 before 10-12-01 and Version 9 branches - including 9(32) and Additional Function variants - from 09-00/09-02 through 09-66-22 or 09-66/V. Hitachi has released fixed versions; EPSS is 0.45% (39th percentile), no public exploit was identified at time of analysis, and vuln.today priority guidance is act_now despite the conflicting urgency signals noted in the independent assessment.
Authentication bypass in Hitachi HiRDB Server (CWE-290, spoofing) lets a remote attacker who can reach the database service impersonate a trusted party and slip past authentication, with maximum impact on confidentiality, integrity and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). All five listed build lines are affected: Server Version 10 (10-00 before 10-12-01), Version 9 and Version 9(32) plus their 'with Additional Function' variants across the 09-00/09-02 to 09-66 branches. Exploitation is unauthenticated and needs no user interaction, so real-world risk is governed mainly by whether the HiRDB listener is reachable from untrusted networks; EPSS is low at 0.64% (51st percentile) and no public exploit has been identified at time of analysis, but the vendor has published a fix and the case is triaged act_now, so exposure should be checked rather than assumed benign.
Unauthenticated network attackers can invoke a critical HiRDB Server function without an authentication check, exposing affected Hitachi HiRDB Version 10 and Version 9-family deployments to high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is CWE-306 and is reachable over the network with no privileges or user interaction; Hitachi reports a vendor patch and the vuln.today decision is act_now, while EPSS is 0.61% (49th percentile). No CISA KEV status is provided, and no public exploit identified at time of analysis; Version 10 is fixed in 10-12-01, while the supplied data does not name fixed builds for the Version 9, Version 9(32), or 'with Additional Function' branches.
Stack-based buffer overflow in Hitachi HiRDB Server can corrupt memory and, per the supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8), is scored as remotely reachable by an unauthenticated attacker with no user interaction, yielding high confidentiality, integrity and availability impact. Affected builds are HiRDB Server Version 10 (10-00 before 10-12-01), Version 9 (09-00 through 09-66-22), Version 9 with Additional Function (09-00 through 09-66/V), Version 9(32) (09-02 through 09-66-22) and Version 9(32) with Additional Function (09-00 through 09-66-/V); EPSS is low at 0.52% (44th percentile) and no public exploit has been identified at time of analysis, although the vuln.today decision label is act_now and Hitachi has published an advisory with a vendor patch available.
Heap-based buffer overflow in Hitachi HiRDB Server affects Version 10 builds from 10-00 before 10-12-01 and multiple Version 9 branches (09-00 through 09-66-22, and the Additional Function and 9(32) variants through 09-66/V), allowing a remote, unauthenticated attacker who can reach the database service to corrupt heap memory with high impact on confidentiality, integrity and availability (CVSS 9.8). No public exploit code was identified at time of analysis and EPSS is low at 0.52% (44th percentile), so the exploitability signal is weak even though severity is critical. The priority label is act_now, driven by the maximum-severity network-reachable overflow rather than by observed exploitation, and Hitachi has released updated builds.
OS command injection in Hitachi HiRDB Server (Version 10 builds from 10-00 before 10-12-01, and Version 9 / Version 9 Additional Function / Version 9(32) / Version 9(32) Additional Function builds from 09-00 through the various 09-66-xx releases) could let an attacker run arbitrary operating-system commands under the database server's privileges; Hitachi's own CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), i.e. remote and unauthenticated with no user interaction, although the specific injectable interface or trigger is not described in the available sources. Signals are mixed: severity and vendor priority are high (vuln.today decision label act_now, EPSS 1.77% at the 78th percentile, indicating above-average but not top-tier predicted exploitation likelihood), yet no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Affected organizations are those running the listed Hitachi HiRDB enterprise RDBMS builds where the vulnerable interface is network-reachable; Hitachi has released fixes in its advisory hitachi-sec-2026-146.
Information disclosure in Hitachi HiRDB Server can be triggered by remote, unauthenticated attackers over the network, with high confidentiality impact and no integrity or availability impact (CVSS 7.5). The flaw is classified as an origin validation error (CWE-346) and affects HiRDB Server Version 10 before 10-12-01, HiRDB Server Version 9 through 09-66-22, HiRDB Server with Additional Function Version 9 through 09-66/V, HiRDB Server Version 9(32) through 09-66-22, and HiRDB Server with Additional Function Version 9(32) through 09-66-/V. EPSS is low at 0.21% (10th percentile), there is no CISA KEV confirmation, and no public exploit was identified at time of analysis; the vendor has released a patch.
Stack-based buffer overflow in Hitachi HiRDB Server allows remote, unauthenticated attackers to corrupt memory and potentially execute code, with high confidentiality and integrity impact. The affected ranges are Version 10 from 10-00 before 10-12-01 and Version 9 branches - including 9(32) and Additional Function variants - from 09-00/09-02 through 09-66-22 or 09-66/V. Hitachi has released fixed versions; EPSS is 0.45% (39th percentile), no public exploit was identified at time of analysis, and vuln.today priority guidance is act_now despite the conflicting urgency signals noted in the independent assessment.