{"id":"CVE-2026-86577","kind":"vulnerability","aliases":["CVE-2026-86577"],"related":[],"title":"JP1 products: out-of-bounds write flaw in multiple management tools","description":"Out-of-bounds Write Vulnerability in JP1 Products.\n\nThis issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.","summary":"JP1 is Hitachi's enterprise IT management suite, and several of its components contain an out-of-bounds write flaw. The sources do not say which input triggers it or what an attacker gains beyond memory corruption in the affected service.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-it-management","hitachi","infrastructure","job-scheduling","jp1"],"not_affected_if":["version-outside-listed-range"],"how_to_check":"- Check the installed JP1/Base version with the JP1 version command or the product's installed-software list; compare it against `12-50-54` and later.\n- Check the JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition versions against `13-50-31`.\n- unknown for any other check, since the sources do not name a command or file.","fix":"- Upgrade JP1/Base from 11-00 or 12-00 range to `12-50-54` or later.\n- Upgrade JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 (Manager, Agent, Agent Minimal Edition) from 13-00 range to `13-50-31` or later.\n- Vendor advisory details and patch files are not in the sources; check Hitachi's JP1 security page.","status":"open","published_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:03+00:00","triaged_at":"2026-10-27T10:31:43+00:00","updated_at":"2026-10-27T10:31:43+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T10:31:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade JP1/Base from 11-00 or 12-00 range to `12-50-54` or later.\n- Upgrade JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 (Manager, Agent, Agent Minimal Edition) from 13-00 range to `13-50-31` or later.\n- Vendor advisory details and patch files are not in the sources; check Hitachi's JP1 security page.","reach":"unknown","title":"JP1 products: out-of-bounds write flaw in multiple management tools","impact":"high","summary":"JP1 is Hitachi's enterprise IT management suite, and several of its components contain an out-of-bounds write flaw. The sources do not say which input triggers it or what an attacker gains beyond memory corruption in the affected service.","category":"infrastructure","nicknames":[],"who_cares":["jp1","hitachi","job-scheduling","enterprise-it-management"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; an out-of-bounds write can corrupt memory and may allow code execution","analyst_note":"Find Hitachi's JP1 advisory for CVE-2026-86577 to confirm the trigger, network reach, auth requirement and exact fixed versions.","how_to_check":"- Check the installed JP1/Base version with the JP1 version command or the product's installed-software list; compare it against `12-50-54` and later.\n- Check the JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 Manager, Agent and Agent Minimal Edition versions against `13-50-31`.\n- unknown for any other check, since the sources do not name a command or file.","needs_analyst":true,"not_affected_if":["version-outside-listed-range"],"who_is_affected":"Teams running any listed JP1 version: JP1/Integrated Management 3 Manager, JP1/Automatic Job Management System 3 Manager or Agent (including Agent Minimal Edition), or JP1/Base. The sources do not say whether a default install is exposed or whether the flaw needs a network path, so the exposure of each host is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000732,"input_tokens":3398,"output_tokens":784,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-00':89C,102C,115C,130C,138C '-2026':14A,17A '-31':93C,106C,119C,134C '-50':92C,105C,118C,133C,141C '-54':142C '-86577':15A,18A '11':137C '12':140C '13':88C,91C,101C,104C,114C,117C,129C,132C '3':85C,98C,111C,124C 'affect':69B,82C 'agent':112C,125C 'attack':62B 'beyond':64B 'bound':6A,47B,74C 'compon':41B 'contain':42B 'corrupt':66B 'cve':13A,16A 'edit':127C 'enterpris':20B,33B 'enterprise-it-manag':19B 'flaw':8A,49B 'gain':63B 'hitachi':23B,31B 'infrastructur':24B 'input':56B 'issu':81C 'job':26B,95C,108C,121C 'job-schedul':25B 'jp1':1A,28B,29B,78C 'jp1/automatic':94C,107C,120C 'jp1/base':135C 'jp1/integrated':83C 'manag':11A,22B,35B,84C,86C,96C,99C,109C,122C 'memori':65B 'minim':126C 'multipl':10A 'out-of-bound':3A,44B,71C 'product':2A,79C 'say':54B 'schedul':27B 'servic':70B 'sever':38B 'sourc':51B 'suit':36B 'system':97C,110C,123C 'tool':12A 'trigger':57B 'vulner':76C 'write':7A,48B,75C","nicknames":[],"mitigations":[],"who_affected":"Teams running any listed JP1 version: JP1/Integrated Management 3 Manager, JP1/Automatic Job Management System 3 Manager or Agent (including Agent Minimal Edition), or JP1/Base. The sources do not say whether a default install is exposed or whether the flaw needs a network path, so the exposure of each host is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86577","severity":null,"published_at":"2026-10-27T10:16:56+00:00","modified_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:03+00:00","fetched_at":"2026-10-27T10:31:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}