{"id":"CVE-2026-86576","kind":"vulnerability","aliases":["CVE-2026-86576"],"related":[],"title":"JP1 products: heap buffer overflow in Hitachi job management suite","description":"Heap-based Buffer Overflow Vulnerability in JP1 Products.\n\nThis issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.","summary":"JP1 is Hitachi's enterprise job scheduling and systems management software, and several of its components contain a heap-based buffer overflow. The sources do not say what input triggers it, but a heap overflow in a management service can let an attacker crash it or potentially run code.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-ops","hitachi","infrastructure","job-scheduling","jp1","linux","windows"],"not_affected_if":["not-running-jp1"],"how_to_check":"- Check the installed JP1/Base version with the product's version command or the installed package list; unknown for the exact command in the sources\n- Check JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition versions against `13-50-31`\n- Check JP1/Base against `12-50-54` (affected from `11-00`)","fix":"- Upgrade JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition to `13-50-31` or later\n- Upgrade JP1/Base to `12-50-54` or later\n- Apply the vendor fix from Hitachi's advisory; the sources do not give the download location","status":"open","published_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:03+00:00","triaged_at":"2026-10-27T10:31:43+00:00","updated_at":"2026-10-27T10:31:43+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T10:31:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition to `13-50-31` or later\n- Upgrade JP1/Base to `12-50-54` or later\n- Apply the vendor fix from Hitachi's advisory; the sources do not give the download location","reach":"unknown","title":"JP1 products: heap buffer overflow in Hitachi job management suite","impact":"high","summary":"JP1 is Hitachi's enterprise job scheduling and systems management software, and several of its components contain a heap-based buffer overflow. The sources do not say what input triggers it, but a heap overflow in a management service can let an attacker crash it or potentially run code.","category":"infrastructure","nicknames":[],"who_cares":["jp1","hitachi","enterprise-ops","job-scheduling","windows","linux"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may run code or crash the JP1 management service","analyst_note":"Check Hitachi's JP1 advisory for the attack vector, required privileges and download links for the fixed versions; NVD alone gives only the description.","how_to_check":"- Check the installed JP1/Base version with the product's version command or the installed package list; unknown for the exact command in the sources\n- Check JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition versions against `13-50-31`\n- Check JP1/Base against `12-50-54` (affected from `11-00`)","needs_analyst":true,"not_affected_if":["not-running-jp1"],"who_is_affected":"Teams running any listed JP1 product in the affected version ranges, typically enterprise operations teams using JP1 for job scheduling or integrated management. Sites that do not run JP1 can skip it. The sources do not say whether the flaw needs network exposure or a particular feature enabled.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000704,"input_tokens":3404,"output_tokens":728,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-00':96C,109C,122C,137C,145C '-2026':12A,15A '-31':100C,113C,126C,141C '-50':99C,112C,125C,140C,148C '-54':149C '-86576':13A,16A '11':144C '12':147C '13':95C,98C,108C,111C,121C,124C,136C,139C '3':92C,105C,118C,131C 'affect':89C 'agent':119C,132C 'attack':71B 'base':48B,80C 'buffer':4A,49B,81C 'code':77B 'compon':43B 'contain':44B 'crash':72B 'cve':11A,14A 'edit':134C 'enterpris':18B,32B 'enterprise-op':17B 'heap':3A,47B,62B,79C 'heap-bas':46B,78C 'hitachi':7A,20B,30B 'infrastructur':21B 'input':57B 'issu':88C 'job':8A,23B,33B,102C,115C,128C 'job-schedul':22B 'jp1':1A,25B,28B,85C 'jp1/automatic':101C,114C,127C 'jp1/base':142C 'jp1/integrated':90C 'let':69B 'linux':26B 'manag':9A,37B,66B,91C,93C,103C,106C,116C,129C 'minim':133C 'op':19B 'overflow':5A,50B,63B,82C 'potenti':75B 'product':2A,86C 'run':76B 'say':55B 'schedul':24B,34B 'servic':67B 'sever':40B 'softwar':38B 'sourc':52B 'suit':10A 'system':36B,104C,117C,130C 'trigger':58B 'vulner':83C 'window':27B","nicknames":[],"mitigations":[],"who_affected":"Teams running any listed JP1 product in the affected version ranges, typically enterprise operations teams using JP1 for job scheduling or integrated management. Sites that do not run JP1 can skip it. The sources do not say whether the flaw needs network exposure or a particular feature enabled.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86576","severity":null,"published_at":"2026-10-27T10:16:56+00:00","modified_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:03+00:00","fetched_at":"2026-10-27T10:31:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}