Hitachi Vantara vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Hitachi Vantara flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization BypassExploited since Mar 3, 2025 · CVSS 8.6
• CVE-2022-43769 Hitachi Vantara Pentaho BA Server Special Element InjectionExploited since Mar 3, 2025 · CVSS 8.8

Latest high and critical flaws

• CVE-2026-108337 An administrator could retrieve the password reset code for any user and take over the account.High 7.4 · Oct 14, 2026
• CVE-2026-108336 When the default self-signed certificate is used, an attacker could gain administrative access to the application.Critical 9.1 · Oct 14, 2026
• CVE-2026-108335 When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.Critical 9.1 · Oct 14, 2026
• CVE-2026-2253 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers fromHigh 7.7 · May 27, 2026
• CVE-2025-11159 Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution wheCritical 9.1 · May 13, 2026
• CVE-2025-11158 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports pubCritical 9.1 · Mar 10, 2026
• CVE-2025-9121 Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data High 8.8 · Dec 15, 2025
• CVE-2025-0756 Overview   The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an ideCritical 9.1 · Apr 16, 2025
• CVE-2024-37361 The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.Critical 9.9 · Feb 19, 2025
• CVE-2024-5706 The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resoHigh 8.8 · Feb 19, 2025
• CVE-2024-5705 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.High 8.8 · Feb 19, 2025
• CVE-2024-37359 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that theHigh 8.6 · Feb 19, 2025
• CVE-2024-28981 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadataHigh 8.5 · Sep 11, 2024
• CVE-2024-28984 Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the AnalyHigh 8.8 · Jun 26, 2024
• CVE-2024-28983 Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the AnalyHigh 8.8 · Jun 26, 2024
• CVE-2024-28982 Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of theHigh 7.1 · Jun 26, 2024
• CVE-2023-3517 Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creatiHigh 8.5 · Dec 12, 2023
• CVE-2023-6538 SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation.High 7.6 · Dec 11, 2023
• CVE-2023-5808 SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation.High 7.6 · Dec 4, 2023
• CVE-2022-4815 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining theHigh 8 · May 24, 2023
• CVE-2022-43941 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoHigh 7.1 · Apr 3, 2023
• CVE-2022-43940 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the dHigh 8.8 · Apr 3, 2023
• CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization BypassExploited · High 8.6 · Apr 3, 2023
• CVE-2022-43938 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scriptiHigh 8.8 · Apr 3, 2023
• CVE-2022-43773 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configurHigh 8.8 · Apr 3, 2023