CVE-2026-115646: Hitachi HiRDB partial string comparison vulnerability

CVE-2026-115646 · Severity: critical · CVSS 9.8 · Published 2026-11-10

HiRDB is a relational database server used for enterprise data management. A partial string comparison vulnerability allows an unauthenticated attacker to remotely execute arbitrary code or gain complete control over the database, including reading, modifying, or deleting sensitive data. This critical flaw affects multiple versions across all major platforms (Windows, Linux, AIX, HP-UX).

Technologies: Hitachi HiRDB Server Version 10, Hitachi HiRDB Server Version 9, Hitachi HiRDB Server Version 9(32), Hitachi HiRDB Server with Additional Function Version 9, Hitachi HiRDB Server with Additional Function Version 9(32). Vendors: Hitachi.

Quick answers

Is CVE-2026-115646 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115646 being exploited in the wild.
How severe is CVE-2026-115646?
Critical severity, with a CVSS score of 9.8, published 10 November 2026.
Which products and versions are affected?
Hitachi HiRDB Server Version 10 10-00 through 10-11-01; 10-12 (partial versions); 10-03 through 10-03-20; 10-02 through 10-02-17; 10-01 through 10-01-12 (multiple platforms: AIX, HP-UX, Linux, Windows); Hitachi HiRDB Server Version 9 09-50-06 through 09-66-22 (AIX, HP-UX, Linux, Windows); Hitachi HiRDB Server Version 9(32) 09-50-06 through 09-66-22 (Windows); Hitachi HiRDB Server with Additional Function Version 9 09-50-/F through 09-66-/V (AIX, HP-UX, Linux, Windows); and 1 more.
Is there a fix for CVE-2026-115646?
Yes: fixed in HiRDB Server Version 10: 10-12-01, 10-11-02, 10-08-05 (AIX, Linux, Windows platforms); Version 9 and Version 9(32) fixes to be released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115646 attacked?
It is attacked over the network.
Am I affected by CVE-2026-115646?
Check whether you run Hitachi HiRDB Server Version 10, Hitachi HiRDB Server Version 9, Hitachi HiRDB Server Version 9(32) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: HiRDB Server Version 10: 10-12-01, 10-11-02, 10-08-05 (AIX, Linux, Windows platforms); Version 9 and Version 9(32) fixes to be released

Technical details

A partial string comparison vulnerability in HiRDB's authentication or access control logic allows bypass via network without authentication. The flaw enables remote code execution or privilege escalation, granting full confidentiality, integrity, and availability compromise of the database (CVSS 9.8 base score). Fixes are available for HiRDB Server Version 10 in releases 10-12-01, 10-11-02, and 10-08-05 across supported platforms.

Affected products

  • Hitachi HiRDB Server Version 10 10-00 through 10-11-01; 10-12 (partial versions); 10-03 through 10-03-20; 10-02 through 10-02-17; 10-01 through 10-01-12 (multiple platforms: AIX, HP-UX, Linux, Windows)
  • Hitachi HiRDB Server Version 9 09-50-06 through 09-66-22 (AIX, HP-UX, Linux, Windows)
  • Hitachi HiRDB Server with Additional Function Version 9 09-50-/F through 09-66-/V (AIX, HP-UX, Linux, Windows)
  • Hitachi HiRDB Server Version 9(32) 09-50-06 through 09-66-22 (Windows)
  • Hitachi HiRDB Server with Additional Function Version 9(32) 09-50-/F through 09-66-/V (Windows)

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.