High severity · published Dec 15, 2025
CVE-2025-9121
Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PD
Pentaho Data Integration and Analytics · Hitachi Vantara
1.0 before 10.2.0.4 · source: vendor
Affected product
PD
Pentaho Data Integration and Analytics
Hitachi Vantara
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9121
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9121
support.pentaho.com
https://support.pentaho.com/hc/en-us/articles/41832536185613--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-4-Impacted-CVE-2025-9121
More from Pentaho Data Integration and Analytics
9.1
CVE-2025-11158
Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization
7.7
CVE-2026-2253
Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference
7.2
CVE-2025-11159
Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component
6.3
CVE-2026-2254
Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource
5.3
CVE-2025-9122
Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information