CVE-2026-71375
Received Received - Intake

XXE Vulnerability in Cosminexus Component Container

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Hitachi, Ltd.

Description
Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-08
Last Modified
2026-09-08
Generated
2026-09-08
AI Q&A
2026-09-08
EPSS Evaluated
N/A
NVD
CVE-2026-71375
EUVD
EUVD-2026-72655

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
hitachi cosminexus_component_container From 09-00 (inc) to 11-70-03 (inc)
hitachi ucosminexus_service_architect *
hitachi ucosminexus_service_platform *
hitachi ucosminexus_service_platform(64) *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an XML External Entity (XXE) vulnerability in Cosminexus Component Container's SOAP communication infrastructure. It affects Cosminexus Service Coordinator when using user-defined reception services or SOAP adapters in SOAP 1.1 mode. The flaw allows improper parsing of XML input, potentially enabling unauthorized access to sensitive data or system disruption.

Detection Guidance

Detecting this XXE vulnerability requires checking for vulnerable Cosminexus Component Container versions and SOAP reception services. Inspect installed software versions against the affected ranges listed in the CVE. Monitor network traffic for unusual XML parsing requests or errors in SOAP communication logs.

Impact Analysis

The vulnerability may lead to unauthorized access to sensitive data, system disruption, or denial of service. Attackers could exploit it to read files, interact with internal systems, or cause service interruptions if the affected Cosminexus components are exposed to untrusted networks.

Mitigation Strategies

Immediately upgrade Cosminexus Component Container to the fixed versions specified for your platform. Disable SOAP 1.1 mode if not required. Review and adjust settings as per the Release.txt file included with the update. Follow Hitachi's official advisory for platform-specific instructions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart