16
CVEs
3
Critical
6
High
0
KEV
0
PoC
4
Unpatched C/H
56.2%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
6
MEDIUM
6
LOW
1
Monthly CVE Trend
Affected Products (30)
Device Manager
11
Vantara Pentaho
7
It Operations Director
6
Jp1 It Desktop Management Manager
5
Tuning Manager
5
Job Management Partner 1 It Desktop Management Manager
5
Ops Center Analyzer
4
Jp1 It Desktop Management 2 Operations Director
4
Eh View
4
Vantara Pentaho Business Intelligence Server
4
Job Management Partner 1 Software Distribution Client
4
Job Management Partner 1 It Desktop Management 2 Manager
4
Cosminexus Component Container
4
Job Management Partner 1 Software Distribution Manager
4
Jp1 It Desktop Management 2 Manager
4
Hitachi Virtual Storage Platform G130 G150 G350 G370 G700 G900 F350 F370 F700 F900
4
Ops Center Common Services
3
Hitachi Virtual Storage Platform E390 E590 E790 E990 E1090 E390H E590H E790H E1090H
3
Pentaho Business Analytics Server
3
Infrastructure Analytics Advisor
3
Jp1 Netm Dm Client
3
Tiered Storage Manager
3
Open Redirect
3
Jp1 Netm Dm Manager
3
Replication Manager
3
Ops Center Api Configuration Manager
2
Hitachi Infrastructure Analytics Advisor
2
Jwt Attack
2
Global Link Manager
2
Hitachi Ops Center Analyzer
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-71374 | Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CWE-502) across a broad range of 09-xx and 11-xx releases. Per the CVSS vector an unauthenticated remote attacker who can deliver a crafted serialized object to a vulnerable endpoint can achieve full confidentiality, integrity, and availability compromise. Hitachi has released fixed maintenance versions; no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-71376 | OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cosminexus/uCosminexus Application Server - allows remote attackers to inject and execute arbitrary operating-system commands (CWE-78). The flaw spans a broad set of legacy and current branches from 09-00 through 11-70 and carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, implying unauthenticated network reachability with full confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 1.0% | 49 |
|
| CVE-2026-71377 | Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allows remote attackers to inject additional arguments into an underlying command invocation, per the vendor CVSS vector enabling full compromise of confidentiality, integrity and availability. A very wide band of releases is affected, spanning the 09-00 through 11-70 trains. No public exploit has been identified at time of analysis, though Hitachi has released fixed maintenance versions. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2025-65115 | Remote code execution in Hitachi's JP1/IT Desktop Management suite allows authenticated network attackers to execute arbitrary code on Windows systems running Manager, Operations Director, and Client components. Affects multiple product generations spanning versions 9.x through 13.x across nine distinct product lines. CVSS score of 8.8 reflects network-accessible attack surface with low complexity requiring only low-privilege authentication. No public exploit identified at time of analysis, though CWE-73 (external control of file name or path) indicates potential for path traversal-based exploitation. Hitachi has released patches addressing versions 13-50-02, 13-11-04, 13-10-07, 13-01-07, 13-00-05, and 12-60-12 for actively supported products. | HIGH | 8.8 | 0.1% | 44 |
|
| CVE-2025-7737 | Remote denial-of-service in Hitachi Virtual Storage Platform (VSP) enterprise storage arrays allows unauthenticated network attackers to disrupt availability through the 10G iSCSI interface across a wide swath of VSP families including E-series, G/F-series, 5000-series, and legacy G1000/G1500/F1500 platforms. The flaw maps to CWE-770 (uncontrolled resource consumption) and carries a CVSS 3.1 base score of 8.6 with a scope-change indicator, meaning impact extends beyond the iSCSI front-end channel to dependent storage services. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2025-1978 | Remote code execution in Hitachi Virtual Storage Platform G, F, E, and One Block series allows unauthenticated network attackers to execute arbitrary code on storage controllers and maintenance consoles with low impact across confidentiality, integrity, and availability due to changed scope (CVSS 8.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C). The vulnerability affects the Storage Navigator interface and maintenance console across multiple VSP product lines spanning enterprise and mid-range storage arrays. EPSS data not available; no evidence of active exploitation or public POC at time of analysis. Vendor-released patches available with specific firmware versions required for each product family. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2025-2902 | Improper authorization in the Maintenance Utility of Hitachi Virtual Storage Platform (VSP) enterprise storage arrays allows an authenticated low-privileged user to perform actions beyond their authorization, undermining the integrity and availability of the storage controller. The flaw affects the VSP E-series, VSP 5000-series, and VSP G/F-series families running pre-fix DKCMAIN and GUM firmware, and was reported by Hitachi itself; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2025-9661 | Remote command injection in Hitachi Virtual Storage Platform One Block versions 23, 24, 26, and 28 allows unauthenticated attackers to execute arbitrary OS commands through the management GUI maintenance utility. The vulnerability affects the DKCMAIN and ESM components prior to versions A3-04-21-40/00 and A3-04-21/00 respectively. With CVSS 8.1 (High) and network attack vector, this represents significant risk to enterprise storage infrastructure, though AC:H indicates exploitation requires specialized conditions. No active exploitation confirmed (not in CISA KEV) and EPSS data not available at time of analysis. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2026-71375 | XML External Entity (XXE) injection in Hitachi Cosminexus Component Container allows unauthenticated remote attackers to disclose sensitive local files or cause a denial of service through maliciously crafted XML input. The vulnerability spans an extensive range of versions across the 09-xx through 11-xx release trains, indicating a long-lived parser misconfiguration in the middleware's XML processing subsystem. No public exploit code or active exploitation has been confirmed; Hitachi has released patches for the actively maintained branches. | HIGH | 7.4 | 0.2% | 37 |
|
| CVE-2025-7386 | Credential exposure in Hitachi Storage Navigator allows authenticated storage administrators to extract insufficiently protected credentials through the network-accessible management interface, potentially enabling lateral movement to systems outside the storage platform's authorization boundary. Affected platforms span the Hitachi VSP 5000-series and G/F/VX-series enterprise storage arrays running pre-patch firmware versions on both the DKCMAIN and SVP components. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS Scope:Changed metric indicates that exposed credentials could be leveraged against systems well beyond Storage Navigator itself. | MEDIUM | 6.8 | 0.2% | 34 |
No patch
|
| CVE-2026-2072 | A Cross-Site Scripting (XSS) vulnerability exists in the Analytics probe component of Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer. The flaw allows authenticated attackers with low privileges to execute malicious scripts in users' browsers, potentially leading to high confidentiality impact, low integrity impact, and low availability impact due to the changed scope (CVSS 8.2). There is no current indication of active exploitation (not in CISA KEV) or publicly available proof-of-concept code. | MEDIUM | 6.1 | 0.0% | 31 |
|
| CVE-2025-65116 | Buffer overflow in Hitachi JP1/IT Desktop Management suite and Job Management Partner 1 software on Windows allows local authenticated users to cause denial of service by triggering memory corruption in affected manager and client components. The vulnerability spans multiple product lines and versions, with CVSS 5.5 indicating moderate local attack surface; active exploitation status not confirmed. | MEDIUM | 5.5 | 0.0% | 28 |
|
| CVE-2025-2514 | Improper restriction of excessive authentication attempts in Hitachi Virtual Storage Platform series (G-series, F-series, E-series, and One Block models) allows unauthenticated remote attackers to conduct brute-force credential attacks and potentially obtain sensitive information through repeated authentication probes without rate-limiting or account lockout mechanisms. The vulnerability affects multiple firmware versions across 28 distinct storage array models and is remotely exploitable without authentication from the network. | MEDIUM | 5.3 | 0.0% | 27 |
No patch
|
| CVE-2026-3314 | Password field masking is absent in Hitachi Ops Center Analyzer, Ops Center Analyzer viewpoint, and Hitachi Infrastructure Analytics Advisor, exposing plaintext credentials to anyone with physical or visual access to the UI. Affected components include the detail view, probe modules, and Analytics probe modules across a wide version range. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects negligible automated exploitation probability. | MEDIUM | 4.6 | 0.0% | 23 |
|
| CVE-2026-1166 | An Open Redirect vulnerability exists in Hitachi Ops Center Administrator versions 10.2.0 through 11.0.7, allowing unauthenticated attackers to redirect users to arbitrary external websites through a crafted URL. The vulnerability requires user interaction (clicking a malicious link) but can be leveraged for phishing attacks, credential harvesting, or malware distribution. There is no indication of active exploitation in the wild or public proof-of-concept availability at this time. | MEDIUM | 4.3 | 0.0% | 22 |
|