Loading story…
Hitachi published security advisories for Hitachi Disk Array Systems covering two vulnerabilities tracked as CVE-2025-1978 and CVE-2025-2902. The notices were issued through Hitachi's Storage Solutions security advisory channel and identify the affected product family as enterprise disk array systems.
The advisories provide vulnerability notifications for storage administrators and security teams monitoring Hitachi infrastructure. While the referenced notices do not include public synopsis details, the disclosures indicate that organizations using Hitachi Disk Array Systems should review the vendor guidance for affected models, exposure, and any recommended remediation or mitigation steps tied to CVE-2025-1978 and CVE-2025-2902.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Hitachi released a separate security advisory covering CVE-2025-2902 affecting Hitachi Disk Array Systems. The advisory was published on March 27, 2026.
Hitachi released a security advisory covering CVE-2025-1978 affecting Hitachi Disk Array Systems. The advisory was published as part of Hitachi Storage Solutions security information on March 27, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
hitachi.com
Open sourcehitachi.com
Open sourcehitachi.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hitachi published security advisories for multiple Linux-based enterprise management products, including **Hitachi Ops Center Administrator**, **Hitachi Infrastructure Analytics Advisor**, **Hitachi Ops Center Analyzer**, **Hitachi Ops Center Analyzer viewpoint**, and **Hitachi Ops Center Viewpoint**. The advisories cover several vulnerabilities across the product line, including an open redirect flaw in Ops Center Administrator tracked as `CVE-2026-1166` and another vulnerability affecting Infrastructure Analytics Advisor and Ops Center Analyzer tracked as `CVE-2026-2072`. The Canadian Centre for Cyber Security alerted organizations to the disclosures and urged administrators to review Hitachi’s guidance, apply recommended mitigations, and install the necessary updates. The newer Hitachi advisory expands the affected scope to additional Analyzer and Viewpoint components, indicating that enterprises using Hitachi monitoring and management platforms should assess exposure across related products and prioritize patching.
Jun 29, 2026
The Canadian Centre for Cyber Security issued advisory **AV26-993** on October 2, 2026, warning of vulnerabilities affecting **Hitachi Coding Software Suite (HCSS)** identified as of October 1. The control-systems advisory directs users and administrators to Hitachi security information **hitachi-sec-2026-001** and the vendor’s vulnerability information page. A related Hitachi public-statement PDF is also linked in the reporting. The available advisory summaries do not specify vulnerability identifiers, affected versions, technical details, or severity ratings, and provide no information about exploitation. Organizations using HCSS should identify deployed instances and review Hitachi’s guidance to establish applicability and remediation requirements. The Cyber Centre recommends applying necessary updates as they become available; the notice should not be interpreted as confirmation that patches are already available for every affected deployment.
Oct 3, 2026
Hewlett Packard Enterprise disclosed **CVE-2026-23594**, a high-severity remote privilege-escalation vulnerability in certain configurations of **HPE Alletra 6000**, **HPE Alletra 5000**, and **HPE Nimble Storage** arrays running vulnerable *Array OS* firmware. The issue is network-exploitable and can allow an attacker with **low privileges** to elevate to **administrative access**, enabling full compromise of the storage system with high impact to confidentiality, integrity, and availability (CVSS v3.1 **8.8**, vector `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). HPE’s bulletin (**HPESBST04995**) advises organizations to prioritize remediation for exposed or broadly reachable storage management networks, given the potential for data access, disruption, or use of storage/backup infrastructure as a staging point for ransomware. Affected versions include *Array OS* releases **prior to 6.1.2.800** and **6.1.3 prior to 6.1.3.300** across Alletra and Nimble product lines; HPE has released fixes and recommends upgrading to patched versions (including **6.1.2.800** and **6.1.3.300**, as applicable) to mitigate the risk.
Jun 29, 2026