# CVE-2026-86574: Hitachi JP1/Base heap-based buffer overflow

Source: https://junglewise.ai/threats/cve-2026-86574-heap-based-buffer-overflow-vulnerability-in-jp1-base-this-issue  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-86574 · Severity: critical · CVSS 9.8 · Published 2026-10-27

JP1/Base is a job scheduling and system management platform used to automate enterprise operations. A heap-based buffer overflow in JP1/Base allows remote attackers to execute arbitrary code and gain full control of affected systems without authentication. This vulnerability poses a critical risk to organizations relying on JP1/Base for business-critical automation and could lead to complete system compromise, data theft, or service disruption.

Technologies: [Hitachi JP1/Base](https://junglewise.ai/threats/technologies/jp1-base). Vendors: [Hitachi](https://junglewise.ai/threats/vendors/hitachi).

## Quick answers

**Is CVE-2026-86574 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86574 being exploited in the wild.

**How severe is CVE-2026-86574?** Critical severity, with a CVSS score of 9.8, published 27 October 2026.

**Which products and versions are affected?** Hitachi JP1/Base Linux, Solaris, HP-UX: 11-00 to 11-00-31, 11-10 to 11-10-32, 11-50 to 11-50-35, 12-00 to 12-00-34, 12-10 to 12-10-11, 12-50 to 12-50-53; AIX: 11-00 to 11-00-31, 11-10 to 11-10-32, 11-50 to 11-50-34, 12-00 to 12-00-34, 12-10 to 12-10-11, 12-50 to 12-50-53.

**Is there a fix for CVE-2026-86574?** Yes: fixed in JP1/Base 12-50-54, 11-50-36 (Linux, AIX, HP-UX, Solaris). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86574 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-86574?** Check whether you run Hitachi JP1/Base at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in JP1/Base 12-50-54, 11-50-36 (Linux, AIX, HP-UX, Solaris)

## Technical details

A heap-based buffer overflow vulnerability exists in JP1/Base versions before 12-50-54 and 11-50-36. The vulnerability is remotely exploitable without authentication or user interaction (CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), allowing unauthenticated remote attackers to execute arbitrary code and achieve complete system compromise with high impact on confidentiality, integrity, and availability.

## Affected products

- Hitachi JP1/Base Linux, Solaris, HP-UX: 11-00 to 11-00-31, 11-10 to 11-10-32, 11-50 to 11-50-35, 12-00 to 12-00-34, 12-10 to 12-10-11, 12-50 to 12-50-53; AIX: 11-00 to 11-00-31, 11-10 to 11-10-32, 11-50 to 11-50-34, 12-00 to 12-00-34, 12-10 to 12-10-11, 12-50 to 12-50-53

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-156/index.html](https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-156/index.html)

## Related threats

- [Hitachi JP1 out-of-bounds write vulnerability](https://junglewise.ai/threats/cve-2026-86577-out-of-bounds-write-vulnerability-in-jp1-products-this-issue)
- [Hitachi JP1 heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-86576-heap-based-buffer-overflow-vulnerability-in-jp1-products-this)
- [Hitachi JP1 stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-86575-stack-based-buffer-overflow-vulnerability-in-jp1-products-this)