Hitachi JP1/Automatic Job Management System 3: Authentication bypass in Manager

Summary

CVE-2026-76938 is an authentication bypass in the Manager component of Hitachi JP1/Automatic Job Management System 3 (JP1/AJS3), a job scheduling and workload automation tool. The vendor rates it CVSS 9.8 (critical) because it can be exploited over the network without privileges or user interaction. A successful attacker could gain unauthorized access to the Manager, which typically has broad access to other systems and runs with elevated rights.

Affected

• JP1/Automatic Job Management System 3 - Manager from 10-00 before 13-50-31 (CNA record)
• Vendor advisory lists affected versions for Windows, Linux, AIX, HP-UX and Solaris; the full affected-version table could not be fully verified
• Unknown: whether the 12-60 and 11-50 branches are affected by this specific CVE

Fixed in

• Windows and Linux: 13-50-31, 12-60-53, 11-50-39
• AIX, HP-UX and Solaris: 12-60-53, 11-50-39
• Contact Hitachi support for details on fixed products as stated in the advisory

Workaround

• Unknown. No vendor workaround found in the sources.
• If patching cannot be done quickly, restrict network access to the Manager to trusted hosts and administrators.

Exploitation

• No confirmed exploitation known at the time of research.
• VulDB states that no technical details or exploit are publicly available.
• Not listed in CISA KEV according to a third-party mirror; not verified directly with CISA.

Our recommendation

• Check whether any JP1/AJS3 Manager is reachable from outside the internal network or from less-trusted segments and restrict access immediately.
• Confirm the correct fixed version for your platform and branch in the full vendor advisory and patch in one pass together with the other CVEs in this advisory.
• Monitor the Manager for unexpected logins and administrative actions until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Hitachi security advisory hitachi-sec-2026-142 www.hitachi.com
• VulDB 427109 vuldb.com
• Hitachi security advisory hitachi-sec-2026-140 www.hitachi.com
• Strix CVE-2026-76938 www.strix.ai
• ThreatInt CVE-2026-76938 cve.threatint.com
• Hitachi JP1/AJS3 product page www.hitachi.asia

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:26.