Hitachi Vantara vulnerabilities
We track 21 vulnerabilities in Hitachi Vantara products across 4 products. 21 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 14, 2026.
Latest Hitachi Vantara vulnerabilities
- 7.4 High severity
Remot Ops Agent: Weak Password Recovery Mechanism for Forgotten Password
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator ac
- 9.1 Critical severity
Remot Ops Agent: Use of Hard-coded Cryptographic Key
When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the defaul
- 9.1 Critical severity
Remote Ops Agent: Weak Password Recovery Mechanism for Forgotten Password
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force soluti
- 7.7 High severity
Pentaho Data Integration and Analytics: Improper Restriction of XML External Entity Reference
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
- 9.1 Critical severity
Pentaho Data Integration and Analytics: Missing Authorization
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.
- 8.8 High severity
Pentaho Data Integration and Analytics: Deserialization of Untrusted Data
Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.
- 9.1 Critical severity
Pentaho Data Integration & Analytics: Improper Control of Resource Identifiers
Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Description Hitachi Vanta
- 9.9 Critical severity
Pentaho Data Integration & Analytics: Deserialization of Untrusted Data
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data
- 8.8 High severity
Pentaho Data Integration & Analytics: Improper Control of Resource Identifiers
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Hitachi Vantara Pentaho Data Integ
- 8.8 High severity
Pentaho Data Integration & Analytics: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. (CWE-863) Hitachi Vantara Pentaho Business
- 8.6 High severity
Pentaho Data Integration & Analytics: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. (CWE-918) Hitachi Vantara Pentaho Business Analy
- 8.5 High severity
Pentaho Data Integration & Analytics: Insufficiently Protected Credentials
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadata injectable fields.
- 8.2 High severity
Pentaho Business Analytics Server: Improper Restriction of Recursive Entity References in DTDs
Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.
- 8.8 High severity
Pentaho Data Integration & Analytics: Improper Control of Resource Identifiers
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
- 8.8 High severity
Pentaho Business Analytics Server: Deserialization of Untrusted Data
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
- 8.1 High severity
Pentaho Business Analytics Server: Incorrect Authorization
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashboard editor plugin API.
- 8.8 High severity
Pentaho Business Analytics Server: Incorrect Authorization
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service.
- 9.8 Critical severity
Hitachi Vantara Pentaho BA Server Authorization Bypass Exploited
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
- 8.8 High severity
Pentaho Business Analytics Server: Improper Control of Generation of Code
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.
- 8.8 High severity
Pentaho Business Analytics Server: Incorrect Permission Assignment for Critical Resource
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled.
- 7.2 High severity
Hitachi Vantara Pentaho BA Server Special Element Injection Exploited
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.