CVE-2026-2072

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2072", "assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "state": "PUBLISHED", "assignerShortName": "Hitachi", "dateReserved": "2026-02-06T07:41:41.771Z", "datePublished": "2026-03-25T02:15:44.430Z", "dateUpdated": "2026-03-25T13:29:19.385Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "shortName": "Hitachi", "dateUpdated": "2026-03-25T02:15:44.430Z"}, "title": "Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "Hitachi", "product": "Hitachi Infrastructure Analytics Advisor", "platforms": ["Linux", "64 bit"], "modules": ["Analytics probe"], "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Ops Center Analyzer", "platforms": ["Linux", "64 bit"], "versions": [{"status": "affected", "version": "10.0.0-00", "lessThan": "11.0.5-00", "changes": [{"at": "11.0.5-00", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.<p>This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.</p>"}]}], "references": [{"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-114/index.html", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L"}}], "source": {"advisory": "hitachi-sec-2026-114", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T13:29:10.197265Z", "id": "CVE-2026-2072", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:29:19.385Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2072", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T13:29:10.197265Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:29:15.552Z"}}], "cna": {"title": "Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer", "source": {"advisory": "hitachi-sec-2026-114", "discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hitachi", "modules": ["Analytics probe"], "product": "Hitachi Infrastructure Analytics Advisor", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "platforms": ["Linux", "64 bit"], "defaultStatus": "unaffected"}, {"vendor": "Hitachi", "product": "Hitachi Ops Center Analyzer", "versions": [{"status": "affected", "changes": [{"at": "11.0.5-00", "status": "unaffected"}], "version": "10.0.0-00", "lessThan": "11.0.5-00", "versionType": "custom"}], "platforms": ["Linux", "64 bit"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-114/index.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.<p>This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "shortName": "Hitachi", "dateUpdated": "2026-03-25T02:15:44.430Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2072", "state": "PUBLISHED", "dateUpdated": "2026-03-25T13:29:19.385Z", "dateReserved": "2026-02-06T07:41:41.771Z", "assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "datePublished": "2026-03-25T02:15:44.430Z", "assignerShortName": "Hitachi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Analytics probe"], "platforms": ["Linux", "64 bit"], "product": "Hitachi Infrastructure Analytics Advisor", "vendor": "Hitachi", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux", "64 bit"], "product": "Hitachi Ops Center Analyzer", "vendor": "Hitachi", "versions": [{"changes": [{"at": "11.0.5-00", "status": "unaffected"}], "lessThan": "11.0.5-00", "status": "affected", "version": "10.0.0-00", "versionType": "custom"}]}], "source": "hirt@hitachi.co.jp"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B11AFBE-CEB5-4BE8-A85C-1E1D217AD210", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:ops_center_analyzer:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E51B1AF-90F0-4C9B-8FC4-2C873B037446", "versionEndExcluding": "11.0.5-00", "versionStartIncluding": "10.0.0-00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00."}, {"lang": "es", "value": "Vulnerabilidad de cross-site scripting en Hitachi Infrastructure Analytics Advisor (componente Analytics probe), Hitachi Ops Center Analyzer. Este problema afecta a Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: desde 10.0.0-00 anterior a 11.0.5-00."}], "id": "CVE-2026-2072", "lastModified": "2026-08-12T16:36:25.747", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.3, "source": "hirt@hitachi.co.jp", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2072", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T13:29:10.197265Z", "version": "2.0.3"}}]}, "published": "2026-03-25T03:16:05.850", "references": [{"source": "hirt@hitachi.co.jp", "tags": ["Vendor Advisory"], "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-114/index.html"}], "sourceIdentifier": "hirt@hitachi.co.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "hirt@hitachi.co.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux", "64_bit"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "Hitachi Infrastructure Analytics Advisor", "source": "cna", "vendor": "Hitachi"}, "product": "infrastructure_analytics_advisor", "vendor": "hitachi"}, {"configurations": [{"platform": ["linux", "64_bit"], "status": "affected", "versions": {"scheme": "generic", "value": "[10.0.0-00,11.0.5-00)"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "Hitachi Ops Center Analyzer", "source": "cna", "vendor": "Hitachi"}, "product": "ops_center_analyzer", "vendor": "hitachi"}], "analysis": {"en": {"generated_at": "2026-03-25T03:20:51.307520+00:00", "value": {"mitigation_remediation": ["Apply the latest vendor patch or upgrade to version 11.0.5\u201100 or newer for both Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer.", "Verify that the upgrade has been performed by checking the product version in the administration console.", "Monitor user reports for unexpected script execution or account takeovers after the update."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Affected versions are Hitachi Infrastructure Analytics Advisor 10.0.0\u201100 up to, but not including, 11.0.5\u201100, and Hitachi Ops Center Analyzer 10.0.0\u201100 up to, but not including, 11.0.5\u201100. These products are used in enterprise infrastructure monitoring and analytics.", "description_and_impact": "The vulnerability is a web application weakness that allows an attacker to inject arbitrary client\u2011side script through the Hitachi Infrastructure Analytics Advisor\u2019s Analytics probe component and the Hitachi Ops Center Analyzer. This client\u2011side code injection can cause the victim\u2019s browser to execute malicious JavaScript, potentially leading to cross\u2011site request forgery, credential theft, or other session\u2011related attacks. The weakness is classified as CWE\u201179, indicating improper input sanitization in a web context.", "risk_and_exploitability": "The CVSS base score of 8.2 reflects a high severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is a web\u2011based input that accepts user data and fails to properly sanitize it, allowing a malicious script to be stored or reflected, requiring an attacker to send a crafted request to the affected system. While the exact prerequisites are not disclosed, such XSS bugs typically require access to the web interface and may succeed without authentication if the input is publicly exposed."}}}}, "created": "2026-03-25T11:35:42.246972+00:00", "updated": "2026-03-25T21:15:58.487968+00:00", "vendors": ["hitachi", "hitachi$PRODUCT$infrastructure_analytics_advisor", "hitachi$PRODUCT$ops_center_analyzer"]}