# CVE-2025-7386: Hitachi Storage Navigator information exposure in external authentication

Source: https://junglewise.ai/threats/cve-2025-7386-hitachi-storage-navigator-information-exposure-in-external  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2025-7386 · Severity: medium · CVSS 6.8 · Published 2026-06-29

Hitachi Storage Navigator, a management tool for high-end enterprise storage systems, contains a vulnerability that can expose sensitive authentication information. This occurs when the system is configured to use external authentication services. While the stored customer data on the disks remains secure, an attacker with high-level administrative privileges could potentially gain access to credentials or other sensitive configuration details, leading to further unauthorized access to the management interface.

Vendors: [Hitachi](https://junglewise.ai/threats/vendors/hitachi).

## Quick answers

**Is CVE-2025-7386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7386 being exploited in the wild.

**How severe is CVE-2025-7386?** Medium severity, with a CVSS score of 6.8, published 29 June 2026.

**Which products and versions are affected?** Hitachi Virtual Storage Platform 5100 DKCMAIN before 90-09-24-00/00 or 90-08-86-00/00; SVP before 90-09-24/00 or 90-08-86/00; Hitachi Virtual Storage Platform G1000 DKCMAIN before 80-06-96-00/00; SVP before 80-06-91/00.

**Is there a fix for CVE-2025-7386?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-7386 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-7386?** Check whether you run Hitachi Virtual Storage Platform 5100, Hitachi Virtual Storage Platform 5100H, Hitachi Virtual Storage Platform 5200 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information exposure vulnerability (CWE-522) exists in Hitachi Storage Navigator when configured for external authentication. The flaw allows an authenticated attacker with high privileges (PR:H) to access sensitive authentication-related information. The vulnerability is triggered during the authentication process with external providers. While the scope is changed (S:C), the impact is limited to confidentiality (C:H), with no direct impact on the integrity or availability of the storage system or the data stored on the disk arrays. Patches are available via micro-program updates for DKCMAIN and SVP components across affected Virtual Storage Platform (VSP) models.

## Affected products

- Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 5500H, 5600H, VX8 DKCMAIN before 90-09-24-00/00 or 90-08-86-00/00; SVP before 90-09-24/00 or 90-08-86/00
- Hitachi Virtual Storage Platform G1000, G1500, F1500, VX7 DKCMAIN before 80-06-96-00/00; SVP before 80-06-91/00

## Timeline

- 2026-03-12: advisory: Initial security information published by Hitachi
- 2026-06-29: disclosed: CVE published to NVD dataset

## References

- [https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_301.html](https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_301.html)

## Related threats

- [Hitachi Virtual Storage Platform DoS in 10G iSCSI Interface](https://junglewise.ai/threats/cve-2025-7737-hitachi-virtual-storage-platform-dos-in-10g-iscsi-interface)