---
id: "CVE-2026-82119"
kind: "vulnerability"
aliases: ["CVE-2026-82119"]
title: "HiRDB database server: OS command injection lets attackers run system commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["database", "hirdb", "linux", "on-prem", "other", "windows"]
not_affected_if: ["version-outside-affected-ranges"]
published_at: "2026-10-27T10:16:56+00:00"
first_seen_at: "2026-10-27T10:31:02+00:00"
updated_at: "2026-10-27T10:31:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82119", "first_seen_at": "2026-10-27T10:31:02+00:00"}]
---

# HiRDB database server: OS command injection lets attackers run system commands

HiRDB, a Japanese relational database server, has an OS command injection flaw in several version 9 and version 10 branches. The sources do not say which input triggers it, but an attacker who can reach the affected service can likely run commands on the host with the server's privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HiRDB Server version against the affected ranges: Version 10 before `10-12-01`, Version 9 from `09-00` through `09-66-22`, and Version 9(32) from `09-02` through `09-66-22`, including the 'with Additional Function' variants.
- Run `unknown` to confirm the exact version command; the sources do not give one.

## Fix

- Upgrade HiRDB Server Version 10 to `10-12-01` or later.
- Upgrade HiRDB Server Version 9 and 9(32) to a release newer than `09-66-22`, and the Additional Function variants to a fixed release (the sources do not name the version).
- Until patched, restrict network access to the HiRDB service to trusted hosts (the sources do not give a specific setting).

## Timeline

- 2026-10-27T10:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82119

## From the sources

OS Command Injection Vulnerability in HiRDB.


This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_