Threat database

CVE-2026-108337 is a vulnerability in Hitachi Vantara Remot Ops Agent versions 1.6.0 through 2.0 that allows an administrator to retrieve password reset codes for any user via an API. These reset codes can be used to take over user accounts. The API is restricted to administrator accounts, so exploitation requires prior administrative access. The vulnerability does not allow access to device credentials or customer data.

CVE-2026-108336 is a critical vulnerability in Hitachi Vantara Remot Ops Agent versions 1.60 through 2.0. The vulnerability arises from the use of a default self-signed SSL certificate to sign JWT access tokens for user authentication. An attacker who exploits this can sign JWT tokens and bypass login, gaining administrative access to the application. However, device credentials and customer data are not accessible through this vulnerability.

CVE-2026-108335 is a critical vulnerability in Hitachi Vantara Remote Ops Agent versions 1.6.0 through 2.0. It involves a weak password recovery mechanism where the password reset functionality lacks rate limiting on reset code attempts. This allows an attacker to brute-force the reset code and take over any account, potentially gaining administrative access to the application. However, device credentials and customer data are not accessible through this vulnerability.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications.

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.

CVE-2025-11158 is a critical vulnerability in Hitachi Vantara Pentaho Data Integration and Analytics versions prior to 10.2.0.6, including 9.3.x and 8.3.x. The flaw arises from missing authorization controls on Groovy scripts embedded in new PRPT reports published by users. This lack of restriction allows attackers with certain privileges to insert arbitrary Groovy scripts, leading to remote code execution (RCE).

EPSS 0.4%VulnerabilityHitachi Vantara#cwe-862United States+9

Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.

EPSS 0.4%VulnerabilityHitachi Vantara#cwe-502United States+9

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.

EPSS 0.3%VulnerabilityHitachi Vantara#cwe-209Germany+7

CVE-2022-43769 is a special element injection vulnerability in Hitachi Vantara Pentaho Business Analytics (BA) Server. It allows attackers to inject Spring templates into properties files, leading to arbitrary command execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-43939 is an authorization bypass vulnerability in Hitachi Vantara Pentaho Business Analytics (BA) Server caused by the use of non-canonical URL paths in authorization decisions. This flaw allows attackers to bypass authorization controls. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.