Hitachi JP1/AJS3 Manager: Heap-based buffer overflow

Summary

Hitachi JP1/Automatic Job Management System 3 - Manager versions 10-00 up to before 13-50-31 contain a heap-based buffer overflow (CWE-122). A remote attacker who can reach the service over the network may be able to crash it or execute arbitrary code, without authentication or user interaction. Whether the vulnerable input path is reachable without authentication is not yet confirmed by the vendor.

Affected

• JP1/Automatic Job Management System 3 - Manager, versions 10-00 to before 13-50-31 (per CNA record)
• Hitachi advisory lists affected Windows builds including 13-50 to 13-50-04, 13-10 to 13-10-06, 13-00 to 13-00-09, 12-60 to 12-60-51, 12-50 to 12-50-52
• Full affected table, including Linux, AIX, HP-UX, Solaris and 10-xx/11-xx lines: Unknown (check the Hitachi advisory)

Fixed in

• Windows and Linux: 13-50-31, 12-60-53, 11-50-39
• AIX, HP-UX, Solaris: 12-60-53, 11-50-39
• 10-xx fix status: Unknown. Ask Hitachi support.

Workaround

Unknown. No vendor workaround was found in the available sources.

Exploitation

• Not known to be exploited; not listed in CISA KEV (per third-party sources)
• No public proof-of-concept found in initial searches
• EPSS: 0.45 % (low)

Our recommendation

• Check whether JP1/AJS3 Manager is installed and at which version.
• Verify whether the service is reachable from the internet or untrusted networks.
• Restrict network access to the AJS3 Manager to management networks until patched.
• Patch to 13-50-31, 12-60-53 or 11-50-39 as applicable, together with the related advisory HITACHI-SEC-2026-143 (CVE-2026-76939).
• Monitor the service for unusual activity and crashes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Hitachi Security Advisory HITACHI-SEC-2026-142 www.hitachi.com
• Hitachi Security Advisory HITACHI-SEC-2026-143 www.hitachi.com
• VulDB entry 427106 vuldb.com
• OffSeq Radar CVE-2026-76937 radar.offseq.com
• Strix CVE-2026-76937 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:47.