CVE-2026-71375

XXE Vulnerability in Cosminexus Component Container

HIGH

7.4

CVSS Score

Published: September 8, 2026 at 07:56 AM UTC

Updated: September 8, 2026 at 02:31 PM UTC

1 product affected across 1 vendorCosminexus Component Container

Using Cosminexus Component Container by Hitachi?

Get instant alerts when new vulnerabilities affect Cosminexus Component Container - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.4

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Cosminexus Component Container · Hitachi

60%

11-0 ≤ v < 11-00-1311-10 ≤ v ≤ 11-10-1111-20 ≤ v < 11-20-1011-30 ≤ v ≤ 11-30-0811-40 ≤ v ≤ 11-40-0311-50 ≤ v ≤ 11-50-0311-60 ≤ v < 11-60-0311-70-1 ≤ v < 11-70-039-0 ≤ v ≤ 09-00-189-50 ≤ v ≤ 09-50-229-70 ≤ v < 09-70-289-80 ≤ v < 09-80-059-87 ≤ v < 09-87-1011-0 11-10 11-20 11-30 11-40 11-50 11-60 11-70-1 9-0 9-50 9-70 9-80 9-87

Affected range stops below 09-70-28, so it looks safe — our inference, not a vendor statement

Affected range stops below 09-80-05, so it looks safe — our inference, not a vendor statement

Affected range stops below 09-87-10, so it looks safe — our inference, not a vendor statement

Affected range stops below 11-00-13, so it looks safe — our inference, not a vendor statement

Affected range stops below 11-20-10, so it looks safe — our inference, not a vendor statement

Affected range stops below 11-60-03, so it looks safe — our inference, not a vendor statement

Affected range stops below 11-70-03, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-131/index.html

References (1)

Vendor Advisory

Source: cverecord

https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-131/index.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.4HIGHHitachi

Attack Vector: NETWORK
Complexity: HIGH
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-611

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card