CVE-2026-71376: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in Hitachi Cosminexus Component Container

This vulnerability (CVE-2026-71376) in Hitachi Cosminexus Component Container is classified as CWE-78: Improper neutralization of special elements used in an OS command ('OS command injection'). It affects multiple specific versions of the product, allowing remote attackers to execute arbitrary OS commands without privileges or user interaction. The vulnerability is critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not published an official fix or remediation level, and no patch links are provided. The product is not a cloud service, so remediation is the responsibility of the user.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on affected systems. This leads to full compromise of confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe, potentially allowing complete control over the affected host.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor Hitachi's advisories for updates. Until a patch is released, consider applying workarounds or restricting access to the affected components to trusted users only.