{"id":"CVE-2026-82119","kind":"vulnerability","aliases":["CVE-2026-82119"],"related":[],"title":"HiRDB database server: OS command injection lets attackers run system commands","description":"OS Command Injection Vulnerability in HiRDB.\n\n\nThis issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.","summary":"HiRDB, a Japanese relational database server, has an OS command injection flaw in several version 9 and version 10 branches. The sources do not say which input triggers it, but an attacker who can reach the affected service can likely run commands on the host with the server's privileges.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","hirdb","linux","on-prem","other","windows"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"- Check the installed HiRDB Server version against the affected ranges: Version 10 before `10-12-01`, Version 9 from `09-00` through `09-66-22`, and Version 9(32) from `09-02` through `09-66-22`, including the 'with Additional Function' variants.\n- Run `unknown` to confirm the exact version command; the sources do not give one.","fix":"- Upgrade HiRDB Server Version 10 to `10-12-01` or later.\n- Upgrade HiRDB Server Version 9 and 9(32) to a release newer than `09-66-22`, and the Additional Function variants to a fixed release (the sources do not name the version).\n- Until patched, restrict network access to the HiRDB service to trusted hosts (the sources do not give a specific setting).","status":"open","published_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","triaged_at":"2026-10-27T10:31:34+00:00","updated_at":"2026-10-27T10:31:34+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T10:31:34Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HiRDB Server Version 10 to `10-12-01` or later.\n- Upgrade HiRDB Server Version 9 and 9(32) to a release newer than `09-66-22`, and the Additional Function variants to a fixed release (the sources do not name the version).\n- Until patched, restrict network access to the HiRDB service to trusted hosts (the sources do not give a specific setting).","reach":"unknown","title":"HiRDB database server: OS command injection lets attackers run system commands","impact":"high","summary":"HiRDB, a Japanese relational database server, has an OS command injection flaw in several version 9 and version 10 branches. The sources do not say which input triggers it, but an attacker who can reach the affected service can likely run commands on the host with the server's privileges.","category":"other","nicknames":[],"who_cares":["hirdb","database","on-prem","linux","windows"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the database host","analyst_note":"Find the vendor advisory from HiRDB's maker (Hitachi) and the fixed version for the 9 and 9(32) branches, and which input or interface triggers the injection.","how_to_check":"- Check the installed HiRDB Server version against the affected ranges: Version 10 before `10-12-01`, Version 9 from `09-00` through `09-66-22`, and Version 9(32) from `09-02` through `09-66-22`, including the 'with Additional Function' variants.\n- Run `unknown` to confirm the exact version command; the sources do not give one.","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Teams running HiRDB Server in the affected version ranges, including those with the Additional Function package, are exposed. The sources do not state which configuration or interface triggers the injection, so the exposure of any given deployment is unknown. Systems running only other databases, or HiRDB versions outside the listed ranges, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000703,"input_tokens":3372,"output_tokens":732,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-00':91C,102C,116C,143C '-01':95C '-02':128C '-12':94C '-2026':13A,16A '-22':106C,132C '-66':105C,119C,131C,146C '-82119':14A,17A '/v':120C,147C '09':101C,104C,115C,118C,127C,130C,142C,145C '10':44B,88C,90C,93C '32':125C,140C '9':41B,99C,113C,124C,139C 'addit':110C,136C 'affect':62B,84C 'attack':8A,57B 'branch':45B 'command':5A,11A,35B,67B,77C 'cve':12A,15A 'databas':2A,18B,30B 'flaw':37B 'function':111C,137C 'hirdb':1A,19B,26B,81C,85C,96C,107C,121C,133C 'host':70B 'inject':6A,36B,78C 'input':52B 'issu':83C 'japanes':28B 'let':7A 'like':65B 'linux':20B 'on-prem':21B 'os':4A,34B,76C 'prem':23B 'privileg':75B 'reach':60B 'relat':29B 'run':9A,66B 'say':50B 'server':3A,31B,73B,86C,97C,108C,122C,134C 'servic':63B 'sever':39B 'sourc':47B 'system':10A 'trigger':53B 'version':40B,43B,87C,98C,112C,123C,138C 'vulner':79C 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Teams running HiRDB Server in the affected version ranges, including those with the Additional Function package, are exposed. The sources do not state which configuration or interface triggers the injection, so the exposure of any given deployment is unknown. Systems running only other databases, or HiRDB versions outside the listed ranges, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82119","severity":null,"published_at":"2026-10-27T10:16:56+00:00","modified_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","fetched_at":"2026-10-27T10:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}