HiRDB Server: Authentication bypass by spoofing

Summary

Hitachi HiRDB Server versions 9, 9(32), 10 and their Additional Function variants contain an authentication bypass by spoofing (CWE-290, CVSS 9.8). An attacker who can reach a HiRDB listener over the network, without credentials or user interaction, may be able to bypass authentication and access the database. The affected ranges depend on the version and platform; Version 10 is fixed in 10-12-01 and later, while no vendor fix is known for the Version 9 families.

Affected

• HiRDB Server Version 10: 10-00 before 10-12-01 (per CNA record)
• HiRDB Server Version 9: 09-00 through 09-66-22
• HiRDB Server with Additional Function Version 9: 09-00 through 09-66/V (the CNA record also writes this as 09-66-/V)
• HiRDB Server Version 9(32): 09-02 through 09-66-22
• HiRDB Server with Additional Function Version 9(32): 09-00 through 09-66-/V
• Platforms in the vendor advisory include AIX, HP-UX, Linux, Solaris and Windows, depending on the version.

Fixed in

• HiRDB Server Version 10: 10-12-01 (vendor fixed products also list 10-11-02 and 10-08-05 for Linux and Windows)
• HiRDB Server Version 9 and 9(32) families: Unknown. Contact Hitachi support.

Workaround

Unknown. No vendor workaround has been published. Restricting network access to HiRDB ports reduces exposure but is not a vendor fix.

Exploitation

• Not known to be exploited as of 27 October 2026 (third-party aggregator data).
• No public proof-of-concept found in the sources checked.
• EPSS: 0.64 % (percentile 51).
• The CVE was published on 27 October 2026, so the absence of reports is a weak signal.

Our recommendation

• Check whether any HiRDB installation exists, including as part of a vendor-supplied application, and record exact versions and platforms.
• Upgrade Version 10 installations to 10-12-01 or later, as listed by the vendor.
• For Version 9 and 9(32) installations, contact Hitachi for a fix or migration path.
• Until patched, restrict access to HiRDB ports to known application and admin hosts and remove any direct internet exposure.
• Monitor authentication and connection logs for unexpected sessions.
• Assess the other HiRDB CVEs published the same day (CVE-2026-82116, CVE-2026-82118, CVE-2026-82119, CVE-2026-82121) together.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Hitachi Vulnerability Information hitachi-sec-2026-149 www.hitachi.com
• CVE-2026-82117 CNA data mirror cve.threatint.com
• OffSeq Radar CVE-2026-82117 radar.offseq.com
• VulDB entry 427111 vuldb.com
• Strix CVE-2026-82117 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:28.