Zero Radar
← feed
CriticalVulnerabilityCVE-2026-86576updated 27 Oct 2026, 10:17 UTC

Hitachi JP1 management software has a heap buffer overflow flaw

A bug in several JP1 management programs could let an attacker write past the memory area they should stay within, which can crash the program or let them take control of it. Hitachi JP1 is software used by companies to schedule jobs and ma

Fix availableOfficial source
SeverityCriticalCVSS 9.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesUpgrade to JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager/Agent/Agent Minimal Edition 13-50-31 or later, and JP1/Base 12-50-54 or later. · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

What happened

A heap-based buffer overflow exists in multiple JP1 products (JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager and Agent, and JP1/Base) in the listed version ranges.

Why it is dangerous: Successful exploitation could allow code execution or a crash of core IT management components, putting job schedulers and the systems they control at risk. Organizations running JP1 for automation and monitoring are most exposed.

Are you affected?

You are affected if you run JP1/Integrated Management 3 - Manager 13-00 to before 13-50-31, JP1/Automatic Job Management System 3 Manager or Agent (including Agent Minimal Edition) 13-00 to before 13-50-31, or JP1/Base 11-00 to before 12-50-54.

JP1/Integrated Management 3 - Manager: 13-00 to before 13-50-31; JP1/Automatic Job Management System 3 - Manager: 13-00 to before 13-50-31; JP1/Automatic Job Management System 3 - Agent: 13-00 to before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: 13-00 to before 13-50-31; JP1/Base: 11-00 to before 12-50-54

What to do

  1. Identify all JP1 products and versions in your environment
  2. Update JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 components to 13-50-31 or later
  3. Update JP1/Base to 12-50-54 or later
  4. Restrict network access to JP1 management interfaces until patched

Timeline

  1. 27 Oct 2026, 10:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 10:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 10:17 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-86576
CVSS
9.4 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 10:16 UTC
On Zero Radar
27 Oct 2026, 10:17 UTC (1 min after disclosure)
Last change
27 Oct 2026, 10:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Hitachi JP1 management software has a heap buffer overflow flaw · Zero Radar