Hitachi JP1: Out-of-bounds write in JP1 Products
Summary
An out-of-bounds write vulnerability (CWE-787) affects several Hitachi JP1 products, including JP1/Integrated Management 3 Manager, JP1/Automatic Job Management System 3 Manager and Agent, and JP1/Base. The CVSS score is 9.4 (Critical). According to the vector, an unauthenticated attacker with network access could corrupt memory, which may affect confidentiality, integrity and availability. Exposure of the affected JP1 services to untrusted networks is the key condition.
Affected
- JP1/Integrated Management 3 - Manager: 13-00 to before 13-50-31
- JP1/Automatic Job Management System 3 - Manager: 13-00 to before 13-50-31
- JP1/Automatic Job Management System 3 - Agent: 13-00 to before 13-50-31
- JP1/Automatic Job Management System 3 - Agent Minimal Edition: 13-00 to before 13-50-31
- JP1/Base: 11-00 to before 12-50-54
Fixed in
- JP1/Integrated Management 3 - Manager: 13-50-31
- JP1/Automatic Job Management System 3 - Manager: 13-50-31
- JP1/Automatic Job Management System 3 - Agent: 13-50-31 (AIX: 13-10-31 scheduled)
- JP1/Automatic Job Management System 3 - Agent Minimal Edition: 13-50-31
- JP1/Base: 12-50-54 or 11-50-36
Workaround
Unknown.
Exploitation
- No public exploit known.
- No confirmed exploitation in the wild found.
- Not listed in CISA KEV.
- EPSS: 0.46 % (percentile 40).
Our recommendation
- Identify all JP1 installations and versions, including JP1/Base as a component.
- Check whether any JP1 manager or agent port is reachable from the internet and restrict access.
- Plan the update to 13-50-31 or 12-50-54 after confirming the versions in the Hitachi advisory.
- Patch CVE-2026-86574, CVE-2026-86575 and CVE-2026-86576 together.
- Monitor for unusual activity on JP1 services until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Hitachi Security Advisory HITACHI-SEC-2026-155 www.hitachi.com
- VulDB 427094 vuldb.com
- OffSeq Radar CVE-2026-86577 radar.offseq.com
- Strix CVE-2026-86577 www.strix.ai
- Threatint CVE-2026-86577 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:46.
Original description (NVD)
Out-of-bounds Write Vulnerability in JP1 Products. This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.