JP1/Automatic Job Management System 3: Heap-based buffer overflow

Summary

Hitachi JP1/Automatic Job Management System 3 Manager and Agent contain a heap-based buffer overflow (CWE-122, CVE-2026-76933) with a CVSS 3.1 base score of 9.4 from the CNA. The flaw can be triggered over the network without privileges or user interaction, which may allow an attacker to affect confidentiality and integrity and to disrupt availability. The CVE record and the vendor page give different lower version bounds, so all versions from 10-00 up to 13-50-30 should be treated as potentially affected.

Affected

• JP1/Automatic Job Management System 3 - Manager: 10-00 to 13-50-30 (vendor page; NVD record says from 11-00)
• JP1/Automatic Job Management System 3 - Agent: 10-00 to 13-50-30 (vendor page; NVD record says from 11-00)
• JP1/Automatic Job Management System 3 - Agent Minimal Edition: 11-50 to 13-50-02 (vendor page)
• Platforms: Windows, Linux, AIX, HP-UX, Solaris (platform-specific ranges in the vendor advisory)

Fixed in

• Manager and Agent, Windows and Linux: 13-50-31, 12-60-53, 11-50-39
• Manager, AIX, HP-UX, Solaris: 12-60-53, 11-50-39
• Agent, AIX: 13-10-31 (as listed by the vendor), 12-60-53, 11-50-39
• Agent, HP-UX and Solaris: 12-60-53, 11-50-39
• Agent Minimal Edition, Windows and Linux: 13-50-31, 12-60-53, 11-50-39
• Vendor advisory hitachi-sec-2026-139 is the authoritative source for exact patch versions.

Workaround

Unknown. No vendor workaround was found in the sources. Ask Hitachi whether an interim measure exists for systems that cannot be patched immediately.

Exploitation

• No confirmed exploitation known at the time of research.
• Some honeypot data mentioned in secondary sources is ambiguous and is not confirmed exploitation.
• No public proof of concept was identified for this CVE.
• EPSS: 0.45 % (percentile 39).

Our recommendation

• Check whether JP1/Automatic Job Management System 3 Manager, Agent or Agent Minimal Edition is installed, including the version.
• Patch to the fixed version for your platform as listed in the Hitachi advisory, prioritising systems with versions 10-00 to 13-50-30.
• Restrict network access to the Manager and Agent ports to known hosts and keep them off the internet.
• Patch the other CVEs in the same Hitachi advisory (CVE-2026-76932 and related entries) with the same upgrade.
• Monitor for unusual connections or service crashes on JP1 hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Hitachi security advisory hitachi-sec-2026-139 www.hitachi.com
• VulDB entry 427093 vuldb.com
• OffSeq radar entry CVE-2026-76933 radar.offseq.com
• Strix CVE-2026-76933 www.strix.ai
• ThreatInt CVE-2026-76933 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:50.