How do I check whether I am affected by CVE-2026-86574?

- Check the installed JP1/Base version on each Hitachi JP1 host; the sources do not give the command or file to read it. - unknown for any other check.

What is the fix for CVE-2026-86574?

- Move JP1/Base to `12-50-54` or later, per the affected range in the sources. - unknown for any interim setting or workaround.

Who is not affected by CVE-2026-86574?

Not affected if: version-12-50-54-or-later.

Live › vulnerability › CVE-2026-86574

Go to dashboard

critical9.8Other

JP1/Base: heap buffer overflow may let an attacker run code

JP1/Base versions 11-00 through 12-50-53 contain a heap-based buffer overflow. The sources do not say what triggers it or what an attacker gets beyond the memory corruption itself.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Heap corruption may allow code execution; the sources do not confirm.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

Teams running JP1/Base from before are affected. The sources do not say which configurations or network exposure make a host reachable, so the rest is unknown.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-86574

Go to dashboard

critical9.8Other

JP1/Base: heap buffer overflow may let an attacker run code

JP1/Base versions 11-00 through 12-50-53 contain a heap-based buffer overflow. The sources do not say what triggers it or what an attacker gets beyond the memory corruption itself.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Heap corruption may allow code execution; the sources do not confirm.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

Teams running JP1/Base from before are affected. The sources do not say which configurations or network exposure make a host reachable, so the rest is unknown.

Know the next one before it finds you.

Add to Slack

JP1/Base: heap buffer overflow may let an attacker run code

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

JP1/Base: heap buffer overflow may let an attacker run code

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources