SECURITYCRITICALCVE-2026-76934

CVE-2026-76934: Hitachi JP1/Automatic Job Management System 3 Unauthenticated Overflow

CVE-2026-76934 (CVSS 9.8) is a remotely reachable stack buffer overflow in Hitachi JP1/AJS3 requiring no authentication. Upgrade to 13-50-31.

Dylan H.

Security Team

October 28, 2026
1 min read
CVE-2026-76934: Hitachi JP1/Automatic Job Management System 3 Unauthenticated Overflow

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • JP1/Automatic Job Management System 3 - Manager 11-00 before 13-50-31
  • JP1/Automatic Job Management System 3 - Agent 11-00 before 13-50-31
  • JP1/Automatic Job Management System 3 - Agent Minimal Edition 11-50 before 13-50-31

Executive Summary

CVE-2026-76934 is the most severe of six JP1/AJS3 memory-safety flaws published October 27, 2026: a stack-based buffer overflow (CWE-121) with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is exploitable over the network without authentication or user interaction.

Affected Versions

ComponentAffectedFixed
JP1/AJS3 Managerup to before 13-50-3113-50-31
JP1/AJS3 Agentup to before 13-50-3113-50-31
Agent Minimal Edition11-50 up to before 13-50-3113-50-31

Sources disagree on the lower bound for Manager and Agent (10-00 versus 11-00). Treat any release older than 13-50-31 as affected.

Exploitation Status

VulDB reports no public exploit, and the CVE is not in CISA KEV. The reservation date was 2026-08-20 and publication 2026-10-27, so the vendor patch has been available since disclosure.

Remediation

  1. Upgrade to 13-50-31 or later (Hitachi-SEC-2026-140).
  2. Block access to JP1/AJS3 ports from untrusted networks immediately if you cannot patch.
  3. Monitor scheduler hosts for crashes and unexpected child processes.

Related CVEs

CVE-2026-76932, CVE-2026-76933, CVE-2026-76935, CVE-2026-76936, CVE-2026-76937.

References