{"id":"CVE-2026-91757","kind":"vulnerability","aliases":["CVE-2026-91757"],"related":[],"title":"Hitachi Dynamic Link Manager for VMware: OS command injection flaw","description":"OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware.\n\nThis issue affects Hitachi Dynamic Link Manager for VMware: from 7.3.0-00 before 9.0.4-01.","summary":"Hitachi Dynamic Link Manager for VMware has an OS command injection flaw in versions 7.3.0-00 before 9.0.4-01. An attacker who can reach the product may be able to run operating system commands on the host.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dynamic-link-manager","hitachi","linux","vendor","vmware","windows"],"not_affected_if":["version-9.0.4-01-or-later"],"how_to_check":"- Check the installed Dynamic Link Manager for VMware version against the affected range (7.3.0-00 up to but not including 9.0.4-01).","fix":"- Hitachi Dynamic Link Manager for VMware: upgrade to `9.0.4-01` or later (the first fixed version in the affected range).","status":"open","published_at":"2026-11-10T05:18:14+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","triaged_at":"2026-11-10T05:22:21+00:00","updated_at":"2026-11-10T05:22:21+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T05:22:21Z","model":"claude-haiku-5-5","output":{"fix":"- Hitachi Dynamic Link Manager for VMware: upgrade to `9.0.4-01` or later (the first fixed version in the affected range).","reach":"unknown","title":"Hitachi Dynamic Link Manager for VMware: OS command injection flaw","impact":"high","summary":"Hitachi Dynamic Link Manager for VMware has an OS command injection flaw in versions 7.3.0-00 before 9.0.4-01. An attacker who can reach the product may be able to run operating system commands on the host.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["hitachi","vmware","dynamic-link-manager","windows","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker runs operating system commands on the managed host","analyst_note":"Confirm attack vector, privileges required and the vendor advisory from Hitachi to verify exposure details.","how_to_check":"- Check the installed Dynamic Link Manager for VMware version against the affected range (7.3.0-00 up to but not including 9.0.4-01).\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-9.0.4-01-or-later"],"who_is_affected":"Organizations running Hitachi Dynamic Link Manager for VMware from 7.3.0-00 before 9.0.4-01 are affected. The sources do not say which configurations or roles are required to exploit it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4528,"output_tokens":564,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-00':41B,85C '-01':44B,88C '-2026':12A,15A '-91757':13A,16A '7.3.0':40B,84C '9.0.4':43B,87C 'abl':54B 'affect':76C 'attack':46B 'command':8A,35B,59B,64C 'cve':11A,14A 'dynam':2A,18B,27B,69C,78C 'dynamic-link-manag':17B 'flaw':10A,37B 'hitachi':1A,21B,26B,68C,77C 'host':62B 'inject':9A,36B,65C 'issu':75C 'link':3A,19B,28B,70C,79C 'linux':22B 'manag':4A,20B,29B,71C,80C 'may':52B 'oper':57B 'os':7A,34B,63C 'product':51B 'reach':49B 'run':56B 'system':58B 'vendor':23B 'version':39B 'vmware':6A,24B,31B,73C,82C 'vulner':66C 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Hitachi Dynamic Link Manager for VMware from 7.3.0-00 before 9.0.4-01 are affected. The sources do not say which configurations or roles are required to exploit it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dynamiclinkmanager","high","hitachi","linux","vendor","vmware","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-91757':13A,16A 'command':8A 'cve':11A,14A 'dynam':2A 'flaw':10A 'hitachi':1A 'inject':9A 'link':3A 'manag':4A 'os':7A 'vmware':6A","search_b":"'-00':41B '-01':44B '7.3.0':40B '9.0.4':43B 'abl':54B 'attack':46B 'command':35B,59B 'dynam':18B,27B 'dynamic-link-manag':17B 'flaw':37B 'hitachi':21B,26B 'host':62B 'inject':36B 'link':19B,28B 'linux':22B 'manag':20B,29B 'may':52B 'oper':57B 'os':34B 'product':51B 'reach':49B 'run':56B 'system':58B 'vendor':23B 'version':39B 'vmware':24B,31B 'window':25B","search_c":"'-00':85C '-01':88C '7.3.0':84C '9.0.4':87C 'affect':76C 'command':64C 'dynam':69C,78C 'hitachi':68C,77C 'inject':65C 'issu':75C 'link':70C,79C 'manag':71C,80C 'os':63C 'vmware':73C,82C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91757","severity":null,"published_at":"2026-11-10T05:18:14+00:00","modified_at":"2026-11-10T05:18:14+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","fetched_at":"2026-11-10T05:19:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}