CriticalVulnerabilityCVE-2026-86575updated 27 Oct 2026, 10:17 UTC

JP1 products have a stack buffer overflow that can allow serious takeover

A flaw in several Hitachi JP1 IT management products lets crafted input overflow a memory area, which can let an attacker run their own commands on the system. Anyone running these products on older versions should update them.

Fix availableOfficial source

Severity	CriticalCVSS 9.4 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	YesUpgrade to 13-50-31 or later for JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 (Manager, Agent, Agent Minimal Edition); upgrade to 12-50-54 or later for JP1/Base. · since 27 Oct 2026
How sure is this?	Official sourceBacked by an official source

What happened

A stack-based buffer overflow affects multiple JP1 products (Integrated Management 3 - Manager, Automatic Job Management System 3 Manager and Agent including Minimal Edition, and JP1/Base) in the version ranges listed below. Source: NVD, CVSS 9.4 (critical).

Why it is dangerous: A stack-based buffer overflow in critical IT management software can let an attacker crash the service or potentially execute code, giving control over managed systems. Organizations running JP1 job scheduling and management infrastructure are at risk.

Are you affected?

You are affected if you run JP1/Integrated Management 3 - Manager 13-00 to before 13-50-31, JP1/Automatic Job Management System 3 Manager or Agent (including Agent Minimal Edition) 13-00 to before 13-50-31, or JP1/Base 11-00 to before 12-50-54.

JP1/Integrated Management 3 - Manager: 13-00 to before 13-50-31; JP1/Automatic Job Management System 3 - Manager: 13-00 to before 13-50-31; JP1/Automatic Job Management System 3 - Agent: 13-00 to before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: 13-00 to before 13-50-31; JP1/Base: 11-00 to before 12-50-54

What to do

Identify all JP1 products and versions in your environment, including Agent and Minimal Edition installs
Update JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 to 13-50-31 or later
Update JP1/Base to 12-50-54 or later
Restrict network access to JP1 management services until patched

Timeline

27 Oct 2026, 10:16 UTC
Publicly disclosed
27 Oct 2026, 10:16 UTC
Reported by NVD · NVD
27 Oct 2026, 10:17 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

CVE-2026-86575NVD · 27 Oct 2026, 10:16 UTC

Technical details

ID: CVE-2026-86575
CVSS: 9.4 / 10
EPSS: 0.5% chance of exploitation within 30 days
Disclosed: 27 Oct 2026, 10:16 UTC
On Zero Radar: 27 Oct 2026, 10:17 UTC (1 min after disclosure)
Last change: 27 Oct 2026, 10:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works