CVE-2026-115646: Partial String Comparison in HiRDB Server
A critical vulnerability has been published for Hitachi HiRDB Server, a relational database used in enterprise and Japanese-market line-of-business systems. Tracked as CVE-2026-115646 and classified as CWE-187 (Partial String Comparison), the flaw carries a CVSS 3.1 base score of 9.8 from the CNA.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-115646 |
| CVSS Score | 9.8 (Critical) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-187 — Partial String Comparison |
| Published | November 10, 2026 |
| Attack Vector | Network, no authentication, no user interaction |
| Known Exploitation | None reported at time of writing |
The vector indicates the weakness is reachable over the network without credentials. NVD enrichment was still pending when this was written, so scoring may change.
Affected Versions
- HiRDB Server Version 10: 10-00 up to, but not including, 10-12-01
- HiRDB Server Version 9: 09-50-06 through 09-66-22
- HiRDB Server with Additional Function Version 9: 09-50-/F through 09-66/V
- HiRDB Server Version 9(32): affected builds per the vendor advisory
Technical Notes
CWE-187 describes code that compares only part of a value (for example, a prefix or a truncated length) when the full value should be matched. In general, such flaws let input that merely begins with, or is shortened to, an expected value be treated as a match, which can undermine validation or access checks.
The vendor has not published exploit-level detail in the sources reviewed, so the precise affected function and the resulting impact in HiRDB should be confirmed against Hitachi's advisory. Treat the CVSS 9.8 rating (high confidentiality, integrity, and availability impact) as the planning baseline.
Remediation
- Version 10 deployments: upgrade to 10-12-01 or later.
- Version 9 deployments: the sources reviewed list no fixed Version 9 build. Check Hitachi's advisory for a patch or migration guidance, and plan an upgrade to Version 10.
- Until patched: restrict network access to HiRDB listener ports to trusted application servers only, and keep the database off untrusted segments.
- Monitor: review database authentication and access logs for anomalous or unexpected successful logins.
Detection
- Inventory HiRDB instances and record version strings against the ranges above.
- Alert on connections to HiRDB ports from hosts outside the expected application tier.
- Watch for unexpected privileged operations or schema reads from unfamiliar clients.
References
- NVD entry for CVE-2026-115646
- Hitachi HiRDB security advisory (see vendor portal)