8
CVEs
3
Critical
3
High
0
KEV
0
PoC
2
Unpatched C/H
50.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
3
MEDIUM
1
LOW
1
Monthly CVE Trend
Affected Products (30)
Device Manager
11
Vantara Pentaho
7
It Operations Director
6
Jp1 It Desktop Management Manager
5
Tuning Manager
5
Job Management Partner 1 It Desktop Management Manager
5
Ops Center Analyzer
4
Jp1 It Desktop Management 2 Operations Director
4
Eh View
4
Vantara Pentaho Business Intelligence Server
4
Job Management Partner 1 Software Distribution Client
4
Job Management Partner 1 It Desktop Management 2 Manager
4
Cosminexus Component Container
4
Job Management Partner 1 Software Distribution Manager
4
Jp1 It Desktop Management 2 Manager
4
Hitachi Virtual Storage Platform G130 G150 G350 G370 G700 G900 F350 F370 F700 F900
4
Ops Center Common Services
3
Hitachi Virtual Storage Platform E390 E590 E790 E990 E1090 E390H E590H E790H E1090H
3
Pentaho Business Analytics Server
3
Infrastructure Analytics Advisor
3
Jp1 Netm Dm Client
3
Tiered Storage Manager
3
Open Redirect
3
Jp1 Netm Dm Manager
3
Replication Manager
3
Ops Center Api Configuration Manager
2
Hitachi Infrastructure Analytics Advisor
2
Jwt Attack
2
Global Link Manager
2
Hitachi Ops Center Analyzer
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-71374 | Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CWE-502) across a broad range of 09-xx and 11-xx releases. Per the CVSS vector an unauthenticated remote attacker who can deliver a crafted serialized object to a vulnerable endpoint can achieve full confidentiality, integrity, and availability compromise. Hitachi has released fixed maintenance versions; no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-71376 | OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cosminexus/uCosminexus Application Server - allows remote attackers to inject and execute arbitrary operating-system commands (CWE-78). The flaw spans a broad set of legacy and current branches from 09-00 through 11-70 and carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, implying unauthenticated network reachability with full confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 1.0% | 49 |
|
| CVE-2026-71377 | Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allows remote attackers to inject additional arguments into an underlying command invocation, per the vendor CVSS vector enabling full compromise of confidentiality, integrity and availability. A very wide band of releases is affected, spanning the 09-00 through 11-70 trains. No public exploit has been identified at time of analysis, though Hitachi has released fixed maintenance versions. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2025-7737 | Remote denial-of-service in Hitachi Virtual Storage Platform (VSP) enterprise storage arrays allows unauthenticated network attackers to disrupt availability through the 10G iSCSI interface across a wide swath of VSP families including E-series, G/F-series, 5000-series, and legacy G1000/G1500/F1500 platforms. The flaw maps to CWE-770 (uncontrolled resource consumption) and carries a CVSS 3.1 base score of 8.6 with a scope-change indicator, meaning impact extends beyond the iSCSI front-end channel to dependent storage services. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2025-2902 | Improper authorization in the Maintenance Utility of Hitachi Virtual Storage Platform (VSP) enterprise storage arrays allows an authenticated low-privileged user to perform actions beyond their authorization, undermining the integrity and availability of the storage controller. The flaw affects the VSP E-series, VSP 5000-series, and VSP G/F-series families running pre-fix DKCMAIN and GUM firmware, and was reported by Hitachi itself; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2026-71375 | XML External Entity (XXE) injection in Hitachi Cosminexus Component Container allows unauthenticated remote attackers to disclose sensitive local files or cause a denial of service through maliciously crafted XML input. The vulnerability spans an extensive range of versions across the 09-xx through 11-xx release trains, indicating a long-lived parser misconfiguration in the middleware's XML processing subsystem. No public exploit code or active exploitation has been confirmed; Hitachi has released patches for the actively maintained branches. | HIGH | 7.4 | 0.2% | 37 |
|
| CVE-2025-7386 | Credential exposure in Hitachi Storage Navigator allows authenticated storage administrators to extract insufficiently protected credentials through the network-accessible management interface, potentially enabling lateral movement to systems outside the storage platform's authorization boundary. Affected platforms span the Hitachi VSP 5000-series and G/F/VX-series enterprise storage arrays running pre-patch firmware versions on both the DKCMAIN and SVP components. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS Scope:Changed metric indicates that exposed credentials could be leveraged against systems well beyond Storage Navigator itself. | MEDIUM | 6.8 | 0.2% | 34 |
No patch
|
| CVE-2025-0824 | Firmware update signature bypass in Hitachi Virtual Storage Platform One Block models 23, 24, 26, and 28 allows an authenticated remote attacker to supply unvalidated firmware packages, potentially compromising storage array integrity and availability. The root cause is CWE-347 (Improper Verification of Cryptographic Signature), and the 'Jwt Attack' tag suggests the firmware validation chain relies on a JWT-based signing mechanism that can be circumvented under specific conditions. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the self-disclosure by Hitachi with a coordinated patch release indicates vendor-confirmed severity. | LOW | 3.7 | 0.1% | 19 |
No patch
|