by Kastro
Paper/Archive/CVE-2026-71374

CVE-2026-71374

Hitachi Cosminexus Component Container — Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.9.469 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

Affected

ProductAffectedFixed inSource
Cosminexus Component Container11-70-01 – < 11-70-0311-70-03CNA
Cosminexus Component Container11-60 – < 11-60-0311-60-03CNA
Cosminexus Component Container11-50 – 11-50-03–CNA
Cosminexus Component Container11-40 – 11-40-03–CNA
Cosminexus Component Container11-30 – 11-30-08–CNA
Cosminexus Component Container11-20 – < 11-20-1011-20-10CNA
Cosminexus Component Container11-10 – 11-10-11–CNA
Cosminexus Component Container11-00 – < 11-00-1311-00-13CNA
Cosminexus Component Container09-87 – < 09-87-1009-87-10CNA
Cosminexus Component Container09-80 – < 09-80-0509-80-05CNA
Cosminexus Component Container09-70 – < 09-70-2809-70-28CNA
Cosminexus Component Container09-50 – 09-50-22–CNA

Scores by source

Hitachi (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryhitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-130/index.html