4
CVEs
3
Critical
1
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
1
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Device Manager
11
Vantara Pentaho
7
It Operations Director
6
Jp1 It Desktop Management Manager
5
Tuning Manager
5
Job Management Partner 1 It Desktop Management Manager
5
Ops Center Analyzer
4
Jp1 It Desktop Management 2 Operations Director
4
Eh View
4
Vantara Pentaho Business Intelligence Server
4
Job Management Partner 1 Software Distribution Client
4
Job Management Partner 1 It Desktop Management 2 Manager
4
Cosminexus Component Container
4
Job Management Partner 1 Software Distribution Manager
4
Jp1 It Desktop Management 2 Manager
4
Hitachi Virtual Storage Platform G130 G150 G350 G370 G700 G900 F350 F370 F700 F900
4
Ops Center Common Services
3
Hitachi Virtual Storage Platform E390 E590 E790 E990 E1090 E390H E590H E790H E1090H
3
Pentaho Business Analytics Server
3
Infrastructure Analytics Advisor
3
Jp1 Netm Dm Client
3
Tiered Storage Manager
3
Open Redirect
3
Jp1 Netm Dm Manager
3
Replication Manager
3
Ops Center Api Configuration Manager
2
Hitachi Infrastructure Analytics Advisor
2
Jwt Attack
2
Global Link Manager
2
Hitachi Ops Center Analyzer
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-71374 | Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CWE-502) across a broad range of 09-xx and 11-xx releases. Per the CVSS vector an unauthenticated remote attacker who can deliver a crafted serialized object to a vulnerable endpoint can achieve full confidentiality, integrity, and availability compromise. Hitachi has released fixed maintenance versions; no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-71376 | OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cosminexus/uCosminexus Application Server - allows remote attackers to inject and execute arbitrary operating-system commands (CWE-78). The flaw spans a broad set of legacy and current branches from 09-00 through 11-70 and carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, implying unauthenticated network reachability with full confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 1.0% | 49 |
|
| CVE-2026-71377 | Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allows remote attackers to inject additional arguments into an underlying command invocation, per the vendor CVSS vector enabling full compromise of confidentiality, integrity and availability. A very wide band of releases is affected, spanning the 09-00 through 11-70 trains. No public exploit has been identified at time of analysis, though Hitachi has released fixed maintenance versions. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-71375 | XML External Entity (XXE) injection in Hitachi Cosminexus Component Container allows unauthenticated remote attackers to disclose sensitive local files or cause a denial of service through maliciously crafted XML input. The vulnerability spans an extensive range of versions across the 09-xx through 11-xx release trains, indicating a long-lived parser misconfiguration in the middleware's XML processing subsystem. No public exploit code or active exploitation has been confirmed; Hitachi has released patches for the actively maintained branches. | HIGH | 7.4 | 0.2% | 37 |
|