{"id":"CVE-2026-86578","kind":"vulnerability","aliases":["CVE-2026-86578"],"related":[],"title":"Hitachi Dynamic Link Manager for Windows: link following lets local users escalate","description":"Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows.\n\nThis issue affects Hitachi Dynamic Link Manager for Windows: from 5.0.0-03 before 9.0.4-01.","summary":"Hitachi Dynamic Link Manager for Windows, versions 5.0.0-03 up to but not including 9.0.4-01, can be tricked into following a symbolic or junction link to a location the user should not reach. The sources do not say what an attacker can read or change through it.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Hitachi Dynamic Link Manager for Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dynamic-link-manager","hitachi","infrastructure","windows"],"not_affected_if":[],"how_to_check":"- Check the installed Dynamic Link Manager version on Windows against the affected range `5.0.0-03` to `9.0.4-01`","fix":"- Hitachi Dynamic Link Manager for Windows: move to `9.0.4-01` or later","status":"open","published_at":"2026-11-10T05:18:11+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","triaged_at":"2026-11-10T05:22:20+00:00","updated_at":"2026-11-10T05:22:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T05:22:20Z","model":"claude-haiku-5-5","output":{"fix":"- Hitachi Dynamic Link Manager for Windows: move to `9.0.4-01` or later","reach":"local","title":"Hitachi Dynamic Link Manager for Windows: link following lets local users escalate","impact":"medium","summary":"Hitachi Dynamic Link Manager for Windows, versions 5.0.0-03 up to but not including 9.0.4-01, can be tricked into following a symbolic or junction link to a location the user should not reach. The sources do not say what an attacker can read or change through it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hitachi","windows","dynamic-link-manager"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; link following may expose files outside the intended path","analyst_note":"Confirm the advisory from Hitachi and the attacker privileges and impact, since the NVD text gives only the affected range.","how_to_check":"- Check the installed Dynamic Link Manager version on Windows against the affected range `5.0.0-03` to `9.0.4-01`\n- unknown for other checks","plain_action":"","product_name":"Hitachi Dynamic Link Manager for Windows","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Hitachi Dynamic Link Manager for Windows in the affected version range. The sources do not say which configurations or roles are exposed, or what an attacker gains beyond the link-following behavior.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4522,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-01':47B,102C '-03':40B,99C '-2026':14A,17A '-86578':15A,18A '5.0.0':39B,98C '9.0.4':46B,101C 'affect':90C 'attack':73B 'chang':77B 'cve':13A,16A 'dynam':2A,26B,33B,83C,92C 'dynamic':20A 'dynamic-link-manag':25B 'escal':12A 'follow':8A,52B,79C 'for':23A 'hitachi':1A,19A,29B,32B,82C,91C 'includ':45B 'infrastructur':30B 'issu':89C 'junction':56B 'let':9A 'link':3A,7A,21A,27B,34B,57B,78C,84C,93C 'local':10A 'locat':60B 'manag':4A,28B,35B,85C,94C 'manager':22A 'reach':65B 'read':75B 'say':70B 'sourc':67B 'symbol':54B 'trick':50B 'user':11A,62B 'version':38B 'vulner':80C 'window':6A,31B,37B,87C,96C 'windows':24A","nicknames":[],"mitigations":[],"who_affected":"Systems running Hitachi Dynamic Link Manager for Windows in the affected version range. The sources do not say which configurations or roles are exposed, or what an attacker gains beyond the link-following behavior.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dynamiclinkmanagerforwindows","hitachidynamiclinkmanagerforwindows"],"ptokens":["dynamic","for","hitachi","link","manager","windows"],"labels":["dynamiclinkmanager","high","hitachi","infrastructure","vendor","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-86578':15A,18A 'cve':13A,16A 'dynam':2A 'dynamic':20A 'escal':12A 'follow':8A 'for':23A 'hitachi':1A,19A 'let':9A 'link':3A,7A,21A 'local':10A 'manag':4A 'manager':22A 'user':11A 'window':6A 'windows':24A","search_b":"'-01':47B '-03':40B '5.0.0':39B '9.0.4':46B 'attack':73B 'chang':77B 'dynam':26B,33B 'dynamic-link-manag':25B 'follow':52B 'hitachi':29B,32B 'includ':45B 'infrastructur':30B 'junction':56B 'link':27B,34B,57B 'locat':60B 'manag':28B,35B 'reach':65B 'read':75B 'say':70B 'sourc':67B 'symbol':54B 'trick':50B 'user':62B 'version':38B 'window':31B,37B","search_c":"'-01':102C '-03':99C '5.0.0':98C '9.0.4':101C 'affect':90C 'dynam':83C,92C 'follow':79C 'hitachi':82C,91C 'issu':89C 'link':78C,84C,93C 'manag':85C,94C 'vulner':80C 'window':87C,96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86578","severity":null,"published_at":"2026-11-10T05:18:11+00:00","modified_at":"2026-11-10T05:18:11+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","fetched_at":"2026-11-10T05:19:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}