Hitachi JP1/Automatic Job Management System 3: Stack-based buffer overflow

Summary

A stack-based buffer overflow (CWE-121) in the Manager and Agent components of Hitachi JP1/Automatic Job Management System 3 (JP1/AJS3) allows an attacker to potentially execute code or crash the service. The CVSS 3.1 base score is 9.8 (Critical) with a network attack vector, low complexity, and no privileges or user interaction required. The exact technical root cause and the lower bound of the affected range are not yet confirmed, so older versions should be treated as potentially affected.

Affected

• JP1/Automatic Job Management System 3 - Manager: 10-00 to before 13-50-31 (per the CNA record; some trackers list 11-00 as the lower bound, unconfirmed)
• JP1/Automatic Job Management System 3 - Agent: 10-00 to before 13-50-31 (per the CNA record; some trackers list 11-00 as the lower bound, unconfirmed)
• JP1/Automatic Job Management System 3 - Agent Minimal Edition: 11-50 to before 13-50-31 (per the CNA record)

Fixed in

• Manager, Linux: 13-50-31, 12-60-53, 11-50-39
• Manager, AIX, HP-UX, Solaris: 12-60-53, 11-50-39
• Agent, Linux: 13-50-31, 12-60-53, 11-50-39
• Agent, AIX: 13-10-31, 12-60-53, 11-50-39
• Agent, HP-UX, Solaris: 12-60-53, 11-50-39
• Agent Minimal Edition, Linux: 13-50-31, 12-60-53, 11-50-39
• Agent Minimal Edition, other platforms: Unknown.

Workaround

Unknown. No workaround or interim mitigation was found in the sources. Patching is the only remediation mentioned.

Exploitation

• No confirmed in-the-wild exploitation known at the time of research.
• No public proof of concept found.
• Not known to be in the CISA KEV catalogue according to a third-party tracker; verification at CISA is pending.
• EPSS: 0.52 % (percentile 44).

Our recommendation

• Inventory all JP1/AJS3 Manager and Agent systems, including versions from 10-00, and confirm the exact installed version.
• Upgrade to the fixed version for your branch as listed by Hitachi, and check the full advisory for platforms not shown in the excerpt.
• Until patched, restrict access to the management ports to trusted hosts only.
• Verify that no JP1/AJS3 system is reachable from the internet.
• Monitor for unusual activity on JP1/AJS3 servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Hitachi Security Information HITACHI-SEC-2026-140 www.hitachi.com
• Hitachi Security Information HITACHI-SEC-2026-143 (related advisory) www.hitachi.com
• CVE record mirror (threatint) cve.threatint.com
• OffSeq Radar: CVE-2026-76934 radar.offseq.com
• Strix: CVE-2026-76934 www.strix.ai
• VulDB entry 427099 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:31.