CVE-2025-11159 identifies a critical vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics, specifically in the embedded JDBC driver for H2 databases. The vulnerability enables external script execution during the creation of a new database connection by a data source administrator. This dependency on a vulnerable third-party component (H2 JDBC driver) exposes the product to high-impact risks including confidentiality, integrity, and availability compromises. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change with high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges (data source administrator) to execute external scripts, potentially leading to full system compromise including data theft, modification, or denial of service. The vulnerability affects all versions of the product listed (1.0). No known exploits have been reported in the wild, but the critical severity and impact scores indicate a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Hitachi Vantara advisories for updates. Until a patch is available, restrict data source administrator privileges to trusted personnel only and consider isolating affected systems to reduce risk exposure.