CVE-2026-71374

CVE-2026-71374 is a deserialization of untrusted data flaw (CWE-502) in the Cosminexus Component Container, the Java application server runtime in Hitachi's Cosminexus middleware stack. An attacker who can reach the component's network-facing interface can supply maliciously crafted serialized data, which is deserialized without authentication (CVSS vector AV:N/AC:L/PR:N/UI:N). Successful exploitation plausibly yields remote code execution or full compromise of confidentiality, integrity and availability, consistent with the critical 9.8 base score. All maintained 09-x and 11-x release streams listed in the advisory are affected, meaning long-lived enterprise deployments on older update levels are exposed. No public proof-of-concept or in-the-wild exploitation is currently known, is not in CISA KEV, and EPSS assigns a low 0.3% probability of exploitation within 30 days.

What to do: Apply Hitachi's fixed update levels: upgrade to 11-70-03 or later, 11-60-03 or later, 11-20-10 or later, 11-00-13 or later, 09-87-10 or later, 09-80-05 or later, or 09-70-28 or later as applicable, and consult the Hitachi advisory for the exact fixed release superseding the affected ranges expressed as 'through' values (e.g., 11-50-03, 09-50-22, 09-00-18). Until patching, restrict network access to the Component Container's service ports to trusted hosts only. Inventory running Cosminexus versions and prioritize internet-reachable or third-party-reachable instances.