{"id":"CVE-2026-91756","kind":"vulnerability","aliases":["CVE-2026-91756"],"related":[],"title":"Hitachi Dynamic Link Manager for VMware: OS command injection flaw","description":"OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware.\n\nThis issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.","summary":"Hitachi Dynamic Link Manager for VMware versions from 8.7.3-00 before 9.0.4-01 contain an OS command injection flaw. A successful attack can let an attacker run operating system commands on the affected host.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dynamic-link-manager","hitachi","other","vmware"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Hitachi Dynamic Link Manager for VMware version; the affected range is `8.7.3-00` up to but not including `9.0.4-01`.","fix":"- Hitachi Dynamic Link Manager for VMware: move to `9.0.4-01` or later.","status":"open","published_at":"2026-11-10T05:18:13+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","triaged_at":"2026-11-10T05:22:12+00:00","updated_at":"2026-11-10T05:22:12+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T05:22:12Z","model":"claude-haiku-5-5","output":{"fix":"- Hitachi Dynamic Link Manager for VMware: move to `9.0.4-01` or later.","reach":"unknown","title":"Hitachi Dynamic Link Manager for VMware: OS command injection flaw","impact":"high","summary":"Hitachi Dynamic Link Manager for VMware versions from 8.7.3-00 before 9.0.4-01 contain an OS command injection flaw. A successful attack can let an attacker run operating system commands on the affected host.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hitachi","vmware","dynamic-link-manager"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker runs operating system commands on the affected host","analyst_note":"Check the Hitachi security advisory for attack prerequisites, authentication requirements and reach; the NVD entry alone does not state them.","how_to_check":"- Check the installed Hitachi Dynamic Link Manager for VMware version; the affected range is `8.7.3-00` up to but not including `9.0.4-01`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running Hitachi Dynamic Link Manager for VMware in the affected version range. The sources do not describe the specific configuration or network exposure needed to trigger the flaw.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4528,"output_tokens":524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-00':33B,80C '-01':36B,83C '-2026':12A,15A '-91756':13A,16A '8.7.3':32B,79C '9.0.4':35B,82C 'affect':56B,71C 'attack':45B,49B 'command':8A,40B,53B,59C 'contain':37B 'cve':11A,14A 'dynam':2A,18B,25B,64C,73C 'dynamic-link-manag':17B 'flaw':10A,42B 'hitachi':1A,21B,24B,63C,72C 'host':57B 'inject':9A,41B,60C 'issu':70C 'let':47B 'link':3A,19B,26B,65C,74C 'manag':4A,20B,27B,66C,75C 'oper':51B 'os':7A,39B,58C 'run':50B 'success':44B 'system':52B 'version':30B 'vmware':6A,23B,29B,68C,77C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Hitachi Dynamic Link Manager for VMware in the affected version range. The sources do not describe the specific configuration or network exposure needed to trigger the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dynamiclinkmanager","high","hitachi","other","vmware"],"campaign_type":null,"search_a":"'-2026':12A,15A '-91756':13A,16A 'command':8A 'cve':11A,14A 'dynam':2A 'flaw':10A 'hitachi':1A 'inject':9A 'link':3A 'manag':4A 'os':7A 'vmware':6A","search_b":"'-00':33B '-01':36B '8.7.3':32B '9.0.4':35B 'affect':56B 'attack':45B,49B 'command':40B,53B 'contain':37B 'dynam':18B,25B 'dynamic-link-manag':17B 'flaw':42B 'hitachi':21B,24B 'host':57B 'inject':41B 'let':47B 'link':19B,26B 'manag':20B,27B 'oper':51B 'os':39B 'run':50B 'success':44B 'system':52B 'version':30B 'vmware':23B,29B","search_c":"'-00':80C '-01':83C '8.7.3':79C '9.0.4':82C 'affect':71C 'command':59C 'dynam':64C,73C 'hitachi':63C,72C 'inject':60C 'issu':70C 'link':65C,74C 'manag':66C,75C 'os':58C 'vmware':68C,77C 'vulner':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91756","severity":null,"published_at":"2026-11-10T05:18:13+00:00","modified_at":"2026-11-10T05:18:13+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","fetched_at":"2026-11-10T05:19:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}