Hitachi JP1: Heap-based buffer overflow in multiple JP1 products

Summary

A heap-based buffer overflow (CWE-122) affects several Hitachi JP1 products, including JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent and Agent Minimal Edition) and JP1/Base. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) indicates that an attacker with network access can exploit it without privileges or user interaction. The sources do not describe the exact impact; the vector suggests high impact on confidentiality and integrity and low impact on availability.

Affected

• JP1/Integrated Management 3 - Manager: 13-00 before 13-50-31
• JP1/Automatic Job Management System 3 - Manager: 13-00 before 13-50-31
• JP1/Automatic Job Management System 3 - Agent: 13-00 before 13-50-31
• JP1/Automatic Job Management System 3 - Agent Minimal Edition: 13-00 before 13-50-31
• JP1/Base: 11-00 before 12-50-54

Fixed in

• JP1/Integrated Management 3 - Manager: 13-50-31
• JP1/Automatic Job Management System 3 - Manager: 13-50-31
• JP1/Automatic Job Management System 3 - Agent (Windows, Linux): 13-50-31
• JP1/Automatic Job Management System 3 - Agent (AIX): 13-10-31 (scheduled, per the advisory)
• JP1/Automatic Job Management System 3 - Agent Minimal Edition: 13-50-31
• JP1/Base: 12-50-54; 11-50-36 for the 11-50 line (per the advisory)

Verify the exact fixed version per product on the Hitachi advisory before patching.

Workaround

Unknown. No vendor-published workaround was found. Restricting network access to JP1 manager and agent ports to management networks is a general interim measure, not vendor guidance.

Exploitation

• No evidence of exploitation in the wild found (OffSeq lists it as not known to be exploited).
• CISA KEV status not confirmed; check the CISA catalog directly.
• No public proof-of-concept found in the searched sources.
• VulDB estimates exploit cost at USD 0-5k; this is a market estimate, not evidence of use.

Our recommendation

• Check whether JP1 products, especially JP1/Base, are present in your environment, including as components of other JP1 products.
• Assess whether any JP1 manager or agent is reachable from the internet or untrusted networks, and restrict access to management networks.
• Confirm the fixed version per product on the Hitachi advisory or with Hitachi support, then patch the management servers first and the agents afterwards.
• Monitor JP1 hosts for abnormal crashes or unexpected processes until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Hitachi Security Advisory HITACHI-SEC-2026-155 www.hitachi.com
• CVE record and NVD data (threatint) cve.threatint.com
• OffSeq exploitation context radar.offseq.com
• VulDB entry CVE-2026-86576 vuldb.com
• Strix CVE-2026-86576 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:45.