CVE-2026-86575

CriticalCVSS 9.4/10Last modified Nov 4, 2026

Description

Stack-based Buffer Overflow Vulnerability in JP1 Products.

This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Hitachi	JP1/Integrated Management 3 - Manager	>= 13-00, < 13-50-31
Hitachi	JP1/Automatic Job Management System 3 - Manager	>= 13-00, < 13-50-31
Hitachi	JP1/Automatic Job Management System 3 - Agent	>= 13-00, < 13-50-31
Hitachi	JP1/Automatic Job Management System 3 - Agent Minimal Edition	>= 13-00, < 13-50-31
Hitachi	JP1/Base	>= 11-00, < 12-50-54

References

https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-155/index.html

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-865769.4Heap-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50 CVE-2026-865779.4Out-of-bounds Write Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP CVE-2026-865787.3Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from CVE-2026-865798.2Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: fro CVE-2026-86588.8OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS c CVE-2026-865838.8The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2 CVE-2026-865857.7The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an a CVE-2026-865895.4Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. CVE-2026-86598.8OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to execute arbitrary OS co CVE-2026-865906.3In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied CVE-2026-865919.8The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated u CVE-2026-865958.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc.