Hitachi JP1/Automatic Job Management System 3: Heap-based buffer overflow

Summary

A heap-based buffer overflow (CWE-122) in the Manager and Agent components of Hitachi JP1/Automatic Job Management System 3 allows an attacker to corrupt memory over the network. No authentication or user interaction is required, so a reachable vulnerable instance can be targeted, which may lead to code execution or denial of service. The vendor rates the issue CVSS 9.8 (Critical). Exploitation requires network access to the affected component.

Affected

• JP1/Automatic Job Management System 3 - Manager: 11-00 before 13-50-31 (per CVE record; Hitachi lists affected branches from 11-00 to 13-50-04 and earlier)
• JP1/Automatic Job Management System 3 - Agent: 11-00 before 13-50-31 (per CVE record; Hitachi lists affected branches from 11-00 to 13-50-06 and earlier)
• Windows and Linux platforms
• Complete branch-by-branch list: see vendor advisory

Fixed in

• Agent: 13-50-31, 12-60-53, 11-50-39 (Windows and Linux)
• Manager: 13-50-31, 12-60-53, 11-50-39 listed in the vendor advisory (to be confirmed in the full table)
• Details: contact Hitachi support

Workaround

Unknown.

Exploitation

• No known exploitation in the wild, not listed in CISA KEV according to secondary sources (not directly verified)
• No public proof of concept found
• EPSS: 0.52 % (percentile 44)

Our recommendation

• Check whether JP1/Automatic Job Management System 3 is installed on Manager or Agent systems, including at customers.
• Upgrade to 13-50-31 or the fixed branch shown in the Hitachi advisory after a test window.
• Until patching, restrict network access to Manager and Agent ports to trusted hosts only and make sure the Manager is not reachable from the internet.
• Monitor for unusual connections or crashes of JP1 services.
• Note that sibling CVEs in the same Hitachi batch, including an authentication bypass, affect the product as well; patch the whole product.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Hitachi advisory HITACHI-SEC-2026-143 www.hitachi.com
• VulDB CVE-2026-76939 vuldb.com
• OffSeq CVE-2026-76939 radar.offseq.com
• Strix CVE-2026-76939 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:27.