# CVE-2026-71375: Hitachi Cosminexus Component Container XXE vulnerability

Source: https://junglewise.ai/threats/cve-2026-71375-hitachi-cosminexus-component-container-xxe-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-71375 · Severity: high · CVSS 7.4 · Published 2026-09-08

Cosminexus Component Container is middleware used to deploy service-oriented business applications. The software contains an XML External Entity (XXE) vulnerability in its SOAP communication layer that allows attackers to read sensitive files or cause service outages. This affects critical infrastructure supporting business operations across Windows, Linux, and AIX platforms.

Technologies: [Hitachi Cosminexus Component Container](https://junglewise.ai/threats/technologies/cosminexus-component-container). Vendors: [Hitachi](https://junglewise.ai/threats/vendors/hitachi).

## Quick answers

**Is CVE-2026-71375 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71375 being exploited in the wild.

**How severe is CVE-2026-71375?** High severity, with a CVSS score of 7.4, published 8 September 2026.

**Which products and versions are affected?** Hitachi Cosminexus Component Container V9 09-00 to 09-87; V11 11-00 to 11-70; Hitachi uCosminexus Service Architect V9 09-00 to 09-70; V11 11-00 to 11-70; Hitachi uCosminexus Service Platform V9 09-00 to 09-87; V11 11-00 to 11-70.

**Is there a fix for CVE-2026-71375?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71375 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71375?** Check whether you run Hitachi Cosminexus Component Container, Hitachi uCosminexus Service Architect or Hitachi uCosminexus Service Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Cosminexus Component Container contains an XXE (XML External Entity) vulnerability in the SOAP communication infrastructure, specifically in user-defined reception services (SOAP reception services) and SOAP adapters operating in SOAP 1.1 mode. The vulnerability is exposed via network-accessible SOAP endpoints and requires no authentication or user interaction. An unauthenticated attacker can craft malicious XML payloads to extract sensitive files from the server or trigger denial-of-service conditions. Fixes are available across supported versions: Cosminexus V11 versions 11-70-03, 11-60-03, 11-20-10, 11-00-13 and Cosminexus V9 versions 09-87-10, 09-80-05, 09-70-28.

## Affected products

- Hitachi uCosminexus Service Architect V9 09-00 to 09-70; V11 11-00 to 11-70
- Hitachi uCosminexus Service Platform V9 09-00 to 09-87; V11 11-00 to 11-70
- Hitachi Cosminexus Component Container V9 09-00 to 09-87; V11 11-00 to 11-70

## Timeline

- 2026-09-08: disclosed: Vulnerability published by Hitachi

## References

- [https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-131/index.html](https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-131/index.html)

## Related threats

- [Hitachi Cosminexus Component Container command argument injection](https://junglewise.ai/threats/cve-2026-71377-hitachi-cosminexus-component-container-command-argument-injection)
- [Hitachi Cosminexus Component Container OS command injection](https://junglewise.ai/threats/cve-2026-71376-hitachi-cosminexus-component-container-os-command-injection)
- [Hitachi Cosminexus Component Container deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-71374-hitachi-cosminexus-component-container-deserialization-of)