This vulnerability (CVE-2026-2253) affects Hitachi Vantara Pentaho Data Integration and Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x. It is classified as CWE-611, indicating improper restriction of XML external entity references. The affected software does not prevent certain XML parsers from resolving external entities, which can lead to unauthorized disclosure of information. The CVSS v3.1 base score is 7.7, reflecting a high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and a confidentiality impact only. The vulnerability has been published but no official fix or patch has been documented in the provided data.

The vulnerability allows attackers with low privileges to exploit XML external entity resolution to gain unauthorized access to confidential information processed by the affected Pentaho Data Integration and Analytics versions. There is no impact on integrity or availability according to the CVSS vector. No known exploits are reported in the wild, so active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented in the provided information, users should monitor Hitachi Vantara's advisories for updates. Until a patch is available, consider restricting access to the affected software and carefully controlling XML input sources to mitigate potential risks.