Is CVE-2025-7737 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-7737 being exploited in the wild.

How severe is CVE-2025-7737?

High severity, with a CVSS score of 8.6, published 19 June 2026.

Which products and versions are affected?

Hitachi Virtual Storage Platform 5000 Series before DKCMAIN Ver.90-09-01-00/01-01, CHB(iSCSI) Ver.90-01-01-07; Hitachi Virtual Storage Platform E-Series before DKCMAIN Ver.93-07-21-80/00-05, CHB(iSCSI) Ver.88-01-02-04; Hitachi Virtual Storage Platform F-Series Multiple versions; see advisory for specific DKCMAIN and CHB/ISFC combinations; Hitachi Virtual Storage Platform G-Series Multiple versions; see advisory for specific DKCMAIN and CHB/ISFC combinations; and 1 more.

Is there a fix for CVE-2025-7737?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-7737 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-7737?

Check whether you run Hitachi Virtual Storage Platform 5000 Series, Hitachi Virtual Storage Platform E-Series, Hitachi Virtual Storage Platform F-Series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-7737: Hitachi Virtual Storage Platform DoS in 10G iSCSI Interface

CVE-2025-7737 · Severity: high · CVSS 8.6 · Published 2026-06-19

A vulnerability in the 10G iSCSI interface of Hitachi Virtual Storage Platforms could allow an attacker to cause a denial-of-service condition. These storage systems are used by enterprises to manage and store critical business data. If exploited, the storage interface may become unresponsive, potentially disrupting access to data and causing operational downtime for applications relying on the storage array.

Technologies: Hitachi Virtual Storage Platform E-Series. Vendors: Hitachi.

Quick answers

Is CVE-2025-7737 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-7737 being exploited in the wild.
How severe is CVE-2025-7737?: High severity, with a CVSS score of 8.6, published 19 June 2026.
Which products and versions are affected?: Hitachi Virtual Storage Platform 5000 Series before DKCMAIN Ver.90-09-01-00/01-01, CHB(iSCSI) Ver.90-01-01-07; Hitachi Virtual Storage Platform E-Series before DKCMAIN Ver.93-07-21-80/00-05, CHB(iSCSI) Ver.88-01-02-04; Hitachi Virtual Storage Platform F-Series Multiple versions; see advisory for specific DKCMAIN and CHB/ISFC combinations; Hitachi Virtual Storage Platform G-Series Multiple versions; see advisory for specific DKCMAIN and CHB/ISFC combinations; and 1 more.
Is there a fix for CVE-2025-7737?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-7737 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-7737?: Check whether you run Hitachi Virtual Storage Platform 5000 Series, Hitachi Virtual Storage Platform E-Series, Hitachi Virtual Storage Platform F-Series or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in the 10G iSCSI interface of various Hitachi Virtual Storage Platform (VSP) models. The flaw is categorized as CWE-770 (Allocation of Resources Without Limits or Throttling), where the iSCSI port becomes unresponsive when it receives a large number of malicious packets. This is a network-based attack that requires no authentication or user interaction. Successful exploitation results in a complete loss of availability for the affected iSCSI interface. Hitachi has released updated microcode (DKCMAIN and CHB/ISFC versions) to mitigate this issue across the affected E, G, F, 5000, and VX series platforms.

Affected products

Hitachi Virtual Storage Platform E-Series (E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H) before DKCMAIN Ver.93-07-21-80/00-05, CHB(iSCSI) Ver.88-01-02-04
Hitachi Virtual Storage Platform G-Series (G100, G130, G150, G200, G350, G370, G400, G600, G700, G800, G900, G1000, G1500) Multiple versions; see advisory for specific DKCMAIN and CHB/ISFC combinations
Hitachi Virtual Storage Platform F-Series (F350, F370, F400, F600, F700, F800, F900, F1500) Multiple versions; see advisory for specific DKCMAIN and CHB/ISFC combinations
Hitachi Virtual Storage Platform 5000 Series (5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H) before DKCMAIN Ver.90-09-01-00/01-01, CHB(iSCSI) Ver.90-01-01-07
Hitachi Virtual Storage Platform VX7, VX8 before DKCMAIN Ver.80-06-93-00/00-04, ISFC Ver.80-01-17

Timeline

2026-06-11: advisory: Initial advisory published by Hitachi
2026-06-19: disclosed: CVE published to NVD dataset

References

https://www.hitachi.com/products/it/storage-solutions/sec_info/2026/2026_312.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.