{"id":"CVE-2026-86575","kind":"vulnerability","aliases":["CVE-2026-86575"],"related":[],"title":"Hitachi JP1 job management: stack buffer overflow in several products","description":"Stack-based Buffer Overflow Vulnerability in JP1 Products.\n\nThis issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.","summary":"JP1 is Hitachi's enterprise IT operations and job scheduling suite, and several of its manager, agent and base components have a stack-based buffer overflow. The sources do not state the trigger or the exact impact, but a stack overflow in this kind of server can let an attacker run code on the affected host.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","hitachi","infrastructure","job-scheduling","jp1","linux","windows"],"not_affected_if":["product-not-installed","version-outside-range"],"how_to_check":"- Check the installed JP1/Base version with the product's version command or the installed package list; affected if below `12-50-54` for 12.x or `11-00` to `12-50-54` range.\n- Check JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition: affected if from `13-00` before `13-50-31`.\n- Confirm whether these components are running and reachable from the network.","fix":"- Upgrade JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition to `13-50-31` or later.\n- Upgrade JP1/Base to `12-50-54` or later.\n- Check the vendor advisory for the exact patch files; the sources do not list them.","status":"open","published_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:03+00:00","triaged_at":"2026-10-27T10:31:43+00:00","updated_at":"2026-10-27T10:31:43+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T10:31:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition to `13-50-31` or later.\n- Upgrade JP1/Base to `12-50-54` or later.\n- Check the vendor advisory for the exact patch files; the sources do not list them.","reach":"unknown","title":"Hitachi JP1 job management: stack buffer overflow in several products","impact":"high","summary":"JP1 is Hitachi's enterprise IT operations and job scheduling suite, and several of its manager, agent and base components have a stack-based buffer overflow. The sources do not state the trigger or the exact impact, but a stack overflow in this kind of server can let an attacker run code on the affected host.","category":"infrastructure","nicknames":[],"who_cares":["hitachi","jp1","job-scheduling","enterprise","windows","linux"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may run code on the JP1 server host.","analyst_note":"Check the Hitachi JP1 security advisory for the trigger, required access, exact fixed versions and platforms; NVD text alone does not say how the overflow is reached.","how_to_check":"- Check the installed JP1/Base version with the product's version command or the installed package list; affected if below `12-50-54` for 12.x or `11-00` to `12-50-54` range.\n- Check JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition: affected if from `13-00` before `13-50-31`.\n- Confirm whether these components are running and reachable from the network.","needs_analyst":true,"not_affected_if":["version-outside-range","product-not-installed"],"who_is_affected":"Teams that run Hitachi JP1 products in their job scheduling or IT operations management stack, especially the manager and agent components reachable over the network. Installations outside the listed version ranges, or without these products, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000713,"input_tokens":3404,"output_tokens":745,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-00':101C,114C,127C,142C,150C '-2026':12A,15A '-31':105C,118C,131C,146C '-50':104C,117C,130C,145C,153C '-54':154C '-86575':13A,16A '11':149C '12':152C '13':100C,103C,113C,116C,126C,129C,141C,144C '3':97C,110C,123C,136C 'affect':81B,94C 'agent':42B,124C,137C 'attack':76B 'base':44B,50B,85C 'buffer':6A,51B,86C 'code':78B 'compon':45B 'cve':11A,14A 'edit':139C 'enterpris':17B,30B 'exact':62B 'hitachi':1A,18B,28B 'host':82B 'impact':63B 'infrastructur':19B 'issu':93C 'job':3A,21B,34B,107C,120C,133C 'job-schedul':20B 'jp1':2A,23B,26B,90C 'jp1/automatic':106C,119C,132C 'jp1/base':147C 'jp1/integrated':95C 'kind':70B 'let':74B 'linux':24B 'manag':4A,41B,96C,98C,108C,111C,121C,134C 'minim':138C 'oper':32B 'overflow':7A,52B,67B,87C 'product':10A,91C 'run':77B 'schedul':22B,35B 'server':72B 'sever':9A,38B 'sourc':54B 'stack':5A,49B,66B,84C 'stack-bas':48B,83C 'state':57B 'suit':36B 'system':109C,122C,135C 'trigger':59B 'vulner':88C 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Hitachi JP1 products in their job scheduling or IT operations management stack, especially the manager and agent components reachable over the network. Installations outside the listed version ranges, or without these products, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86575","severity":null,"published_at":"2026-10-27T10:16:56+00:00","modified_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:03+00:00","fetched_at":"2026-10-27T10:31:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}