Critical severity · published May 7, 2026
CVE-2025-9661
OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23/24/26/28
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28.
This issue affects Hitachi Virtual Storage Platform One Block 23/24/26/28: before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HV
Hitachi Virtual Storage Platform One Block 23 · Hitachi
before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 · source: vendor
HV
Hitachi Virtual Storage Platform One Block 24 · Hitachi
before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 · source: vendor
HV
Hitachi Virtual Storage Platform One Block 26 · Hitachi
before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 · source: vendor
HV
Hitachi Virtual Storage Platform One Block 28 · Hitachi
before DKCMAIN A3-04-21-40/00, ESM A3-04-21/00 · source: vendor
VS
Virtual Storage One Block · Hitachi
23; 24; 26; 28 · source: NVD
Affected product
HV
Hitachi Virtual Storage Platform One Block 23
Hitachi