CVE-2026-71376

CriticalCVSS 9.8/10Last modified Sep 8, 2026

Description

OS command injection vulnerability in Cosminexus Component Container.

This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
HitachiCosminexus Component Container>= 11-70-01, < 11-70-03; >= 11-60, < 11-60-03; >= 11-50, <= 11-50-03; >= 11-40, <= 11-40-03; >= 11-30, <= 11-30-08; >= 11-20, < 11-20-10; >= 11-10, <= 11-10-11; >= 11-00, < 11-00-13; >= 09-87, < 09-87-10; >= 09-80, < 09-80-05; >= 09-70, < 09-70-28; >= 09-50, <= 09-50-22; >= 09-00, <= 09-00-18

References

Timeline

Published
Sep 8, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-713779.8Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-0CVE-2026-713784.6ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resourceCVE-2026-7137910.0The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.CVE-2026-71389.8A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-binCVE-2026-713808.7Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to caCVE-2026-713814.0Adobe Genuine Software Integrity Service on Windows is affected by an Incorrect Authorization vulnerability that could result in a Security CVE-2026-713827.8Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of thCVE-2026-713837.3is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnCVE-2026-713849.6is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnCVE-2026-713858.4ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-713868.8is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. CVE-2026-713878.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre