Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Hitachi JP1 products could let attackers write over memory

CVE-2026-86577 · published today
Summary

Versions of Hitachi JP1 Integrated Management 3, Automatic Job Management System 3 (manager, agent, and minimal edition) and JP1/Base before their latest patches can be tricked into writing data outside intended memory areas. This could allow an attacker to corrupt data or run unwanted code on the server. Apply the newest software updates from Hitachi as soon as possible to close the problem.

What to do
  • Update hitachi jp1/integrated management 3 - manager to version 13-50-31.
  • Update hitachi jp1/automatic job management system 3 - manager to version 13-50-31.
  • Update hitachi jp1/automatic job management system 3 - agent to version 13-10-31.
  • Update hitachi jp1/automatic job management system 3 - agent minimal edition to version 13-50-31.
  • Update hitachi jp1/base to version 11-50-31.
Affected software
VendorProductAffected versions
hitachi jp1/integrated management 3 - manager < 13-50-31
Fix: upgrade to 13-50-31
hitachi jp1/automatic job management system 3 - manager < 13-50-31
Fix: upgrade to 13-50-31
hitachi jp1/automatic job management system 3 - agent < 13-50-31
Fix: upgrade to 13-10-31
hitachi jp1/automatic job management system 3 - agent minimal edition < 13-50-31
Fix: upgrade to 13-50-31
hitachi jp1/base < 12-50-54
Fix: upgrade to 11-50-31
Original advisory text
Out-of-bounds Write Vulnerability in JP1 Products
Out-of-bounds Write Vulnerability in JP1 Products.

This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-86577 · NVD
CVE-2026-86577 · MITRE
Track software like this
Free during beta