Vulnerability · Published Sep 8, 2026 · Assigned by Hitachi
CVE-2026-71374Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Cosminexus Component Container from Hitachi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi | Cosminexus Component Container | 11-70-01 – before 11-70-0311-60 – before 11-60-0311-50 – through 11-50-0311-40 – through 11-40-0311-30 – through 11-30-0811-20 – before 11-20-1011-10 – through 11-10-1111-00 – before 11-00-13 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H