Zero Radar
← feed
CriticalVulnerabilityCVE-2026-86577updated 27 Oct 2026, 10:17 UTC

JP1 management software has a memory write flaw that could let attackers take control

A bug in Hitachi JP1 job and IT management software lets a specially crafted input write data beyond the memory it should, which can crash the software or let an attacker run their own code.

Fix availableOfficial source
SeverityCriticalCVSS 9.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesUpgrade to 13-50-31 or later for the JP1/IM3 Manager and JP1/AJS3 products, and to 12-50-54 or later for JP1/Base. · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

What happened

An out-of-bounds write vulnerability affects several JP1 products (JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager and Agent, and JP1/Base) in the listed version ranges.

Why it is dangerous: The flaw is rated critical (CVSS 9.4). Successful exploitation could allow an attacker to disrupt or fully compromise servers that run job scheduling and central management for an organization.

Are you affected?

You are affected if you run JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 Manager or Agent (including Agent Minimal Edition) from 13-00 before 13-50-31, or JP1/Base from 11-00 before 12-50-54.

JP1/Integrated Management 3 - Manager: 13-00 to before 13-50-31; JP1/Automatic Job Management System 3 - Manager: 13-00 to before 13-50-31; JP1/Automatic Job Management System 3 - Agent: 13-00 to before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: 13-00 to before 13-50-31; JP1/Base: 11-00 to before 12-50-54

What to do

  1. Identify all JP1 products and versions in your environment, including JP1/Base
  2. Update JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 Manager and Agent to 13-50-31 or later
  3. Update JP1/Base to 12-50-54 or later
  4. Restrict network access to JP1 management ports to trusted hosts until patched

Timeline

  1. 27 Oct 2026, 10:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 10:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 10:17 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-86577
CVSS
9.4 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 10:16 UTC
On Zero Radar
27 Oct 2026, 10:17 UTC (1 min after disclosure)
Last change
27 Oct 2026, 10:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

JP1 management software has a memory write flaw that could let attackers take control · Zero Radar