CVE-2026-71376

Cosminexus Component Container, the application server runtime in Hitachi's Cosminexus/uCosminexus platform, contains an OS command injection flaw (CWE-78). Per the CVSS vector, it is exploitable over the network with no authentication and no user interaction, meaning a remote attacker can trigger it by sending crafted input to a network-reachable Component Container service. Successful exploitation yields unauthenticated remote command execution on the host, with high impact to confidentiality, integrity, and availability. Any installation running an affected maintenance version in the 09-00 through 11-70 release lines is exposed, spanning both legacy and current product lines. Exploitation has not been confirmed: there is no known in-the-wild activity, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns roughly a 1% chance of exploitation within 30 days.

What to do: Inventory all servers running Cosminexus Component Container and upgrade each affected maintenance line to the fixed update named in Hitachi's advisory — at minimum 11-70-03, 11-60-03, 11-20-10, 11-00-13, 09-87-10, 09-80-05, and 09-70-28, and for lines where the advisory's range has no stated fix boundary (11-50, 11-40, 11-30, 11-10, 09-50, 09-00) apply the fixed maintenance update Hitachi specifies for that line. Until patching is complete, restrict network access to hosts running Component Container and prioritize auditing any instances reachable from untrusted networks or the internet, given the unauthenticated network-exploitable CVSS vector.