Hitachi HiRDB: OS command injection

Summary

An OS command injection flaw (CWE-78, CVSS 9.8) affects several HiRDB Server branches for Version 9 and 10. An attacker who can reach the affected server over the network without privileges or user interaction may be able to run operating system commands with the server's rights, which could compromise confidentiality, integrity and availability. Whether the flaw is reachable before authentication is not confirmed.

Affected

• HiRDB Server Version 10: 10-00 before 10-12-01
• HiRDB Server Version 9: 09-00 through 09-66-22
• HiRDB Server with Additional Function Version 9: 09-00 through 09-66/V
• HiRDB Server Version 9(32): 09-02 through 09-66-22
• HiRDB Server with Additional Function Version 9(32): 09-00 through 09-66-/V
• Platforms per vendor advisory: AIX, HP-UX, Linux, Solaris, Windows (depending on branch)
• The "/V" and "-/V" suffixes in the CVE record should be verified against the vendor's per-platform tables.

Fixed in

• HiRDB Server Version 10: 10-12-01 (also listed by Hitachi: 10-11-02 and 10-08-05 for other maintenance branches; applicability not verified)
• HiRDB Server Version 9 and 9(32): Unknown.

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found.
• Not listed in CISA KEV according to a third-party tracker; the CISA catalogue was not checked directly.
• No public proof of concept found; the vulnerability is newly published.
• Attack input is unknown.

Our recommendation

• Inventory all HiRDB installations, including versions and platforms.
• Restrict HiRDB server ports to known application and admin hosts; do not expose them to the internet.
• Upgrade HiRDB Server Version 10 to 10-12-01 or later.
• For Version 9 branches, obtain Hitachi's fix status in writing and apply compensating controls until a fix is available.
• Monitor vendor updates, public PoCs and KEV listings.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Hitachi advisory hitachi-sec-2026-146 www.hitachi.com
• CVE record summary (threatint) cve.threatint.com
• VulDB entry 427100 vuldb.com
• OffSeq radar entry CVE-2026-82119 radar.offseq.com
• Strix CVE-2026-82119 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:25.