Threat database

CVE-2026-108337 is a vulnerability in Hitachi Vantara Remot Ops Agent versions 1.6.0 through 2.0 that allows an administrator to retrieve password reset codes for any user via an API. These reset codes can be used to take over user accounts. The API is restricted to administrator accounts, so exploitation requires prior administrative access. The vulnerability does not allow access to device credentials or customer data.

CVE-2026-108336 is a critical vulnerability in Hitachi Vantara Remot Ops Agent versions 1.60 through 2.0. The vulnerability arises from the use of a default self-signed SSL certificate to sign JWT access tokens for user authentication. An attacker who exploits this can sign JWT tokens and bypass login, gaining administrative access to the application. However, device credentials and customer data are not accessible through this vulnerability.

CVE-2026-108335 is a critical vulnerability in Hitachi Vantara Remote Ops Agent versions 1.6.0 through 2.0. It involves a weak password recovery mechanism where the password reset functionality lacks rate limiting on reset code attempts. This allows an attacker to brute-force the reset code and take over any account, potentially gaining administrative access to the application. However, device credentials and customer data are not accessible through this vulnerability.

CVE-2026-82715 is an insecure temporary file vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. It affects versions 01-00 of the AIX driver and 01-04 of the Virtual I/O Server driver prior to 01-23-/A. The vulnerability could allow an attacker with local privileges to cause high impact on integrity and availability. The CVSS score is 7.9 (high severity).

CVE-2026-86573 is an out-of-bounds write vulnerability in the Hitachi Disk Array Driver for AIX and the Hitachi Disk Array Driver for Virtual I/O Server. It affects specific versions starting from 01-00 up to but not including 01-23-/A for AIX, and from 01-04 up to but not including 01-23-/A for the Virtual I/O Server. The vulnerability has a medium severity with a CVSS score of 5.1 and can cause integrity loss and high availability impact without confidentiality compromise.

CVE-2026-86607 is an internal application information exposure vulnerability in Hitachi Ops Center Administrator versions before 11.0.9-01. It involves generation of error messages that contain sensitive information, potentially leaking internal application details. The vulnerability has a medium severity with a CVSS score of 4.3. No known exploits are reported in the wild. The affected versions are all releases from initial up to but not including 11.0.9-01.

Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific functions within production environment depending on how the Asset Suite application is configured.

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment.

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.

Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 through 11-00-12, from 09-87 before 09-87-10, from 09-80 through 09-80-04, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.