CVE-2026-71374: Hitachi Cosminexus Component Container deserialization of untrusted data

CVE-2026-71374 · Severity: critical · CVSS 9.8 · Published 2026-09-08

Cosminexus Component Container is a core component of Hitachi's enterprise application server and middleware products. An insecure deserialization vulnerability allows remote attackers to execute arbitrary code without authentication, potentially compromising the entire application server and any sensitive business data it processes. This could lead to complete system compromise, data theft, or service disruption across dependent business applications.

Technologies: Hitachi Cosminexus Component Container. Vendors: Hitachi.

Quick answers

Is CVE-2026-71374 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71374 being exploited in the wild.
How severe is CVE-2026-71374?
Critical severity, with a CVSS score of 9.8, published 8 September 2026.
Which products and versions are affected?
Hitachi Cosminexus Component Container V9 and V11 versions; specific affected ranges include 09-00 through 09-87, 11-00 through 11-70; Hitachi uCosminexus Application Server V9 and V11; Hitachi uCosminexus Application Server-R V9 and V11; Hitachi uCosminexus Developer V9 and V11; and 3 more.
Is there a fix for CVE-2026-71374?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-71374 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71374?
Check whether you run Hitachi Cosminexus Component Container, Hitachi uCosminexus Application Server, Hitachi uCosminexus Application Server-R or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insecure deserialization flaw in Cosminexus Component Container that allows attackers to deserialize untrusted data. The issue affects multiple versions across Cosminexus V9 and V11 product lines. The vulnerability is remotely exploitable over the network with no authentication required (CVSS vector AV:N/AC:L/PR:N/UI:N), and can result in complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Hitachi has released fixed versions including Cosminexus Component Container 09-70-28, 09-87-10, 11-00-13, 11-20-10, 11-60-03, and 11-70-03 across supported platforms. Organizations using affected versions should upgrade immediately.

Affected products

  • Hitachi Cosminexus Component Container V9 and V11 versions; specific affected ranges include 09-00 through 09-87, 11-00 through 11-70
  • Hitachi uCosminexus Developer V9 and V11
  • Hitachi uCosminexus Application Server V9 and V11
  • Hitachi uCosminexus Application Server-R V9 and V11
  • Hitachi uCosminexus Service Platform V9 and V11
  • Hitachi uCosminexus Service Architect V9 and V11
  • Hitachi uCosminexus Primary Server Base V9 and V11

Timeline

  • 2026-09-08: disclosed: Vulnerability details and advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.