{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1166", "assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "state": "PUBLISHED", "assignerShortName": "Hitachi", "dateReserved": "2026-01-19T05:00:10.434Z", "datePublished": "2026-03-25T02:07:10.895Z", "dateUpdated": "2026-03-25T13:30:24.956Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "shortName": "Hitachi", "dateUpdated": "2026-03-25T02:07:10.895Z"}, "title": "Open Redirect Vulnerability in Hitachi Ops Center Administrator", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-601", "description": "CWE-601 URL redirection to untrusted site ('open redirect')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "CAPEC-98 Phishing"}]}], "affected": [{"vendor": "Hitachi", "product": "Hitachi Ops Center Administrator", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "10.2.0", "lessThan": "11.0.8", "changes": [{"at": "11.0.8", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Open Redirect vulnerability in Hitachi Ops Center Administrator.<p>This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.</p>"}]}], "references": [{"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-113/index.html", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "source": {"advisory": "hitachi-sec-2026-113", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T13:30:17.223904Z", "id": "CVE-2026-1166", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:30:24.956Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1166", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T13:30:17.223904Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:30:21.394Z"}}], "cna": {"title": "Open Redirect Vulnerability in Hitachi Ops Center Administrator", "source": {"advisory": "hitachi-sec-2026-113", "discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "CAPEC-98 Phishing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hitachi", "product": "Hitachi Ops Center Administrator", "versions": [{"status": "affected", "changes": [{"at": "11.0.8", "status": "unaffected"}], "version": "10.2.0", "lessThan": "11.0.8", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-113/index.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.", "supportingMedia": [{"type": "text/html", "value": "Open Redirect vulnerability in Hitachi Ops Center Administrator.<p>This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL redirection to untrusted site ('open redirect')"}]}], "providerMetadata": {"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "shortName": "Hitachi", "dateUpdated": "2026-03-25T02:07:10.895Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1166", "state": "PUBLISHED", "dateUpdated": "2026-03-25T13:30:24.956Z", "dateReserved": "2026-01-19T05:00:10.434Z", "assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "datePublished": "2026-03-25T02:07:10.895Z", "assignerShortName": "Hitachi"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8."}], "id": "CVE-2026-1166", "lastModified": "2026-03-25T15:41:33.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "hirt@hitachi.co.jp", "type": "Secondary"}]}, "published": "2026-03-25T03:16:05.643", "references": [{"source": "hirt@hitachi.co.jp", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-113/index.html"}], "sourceIdentifier": "hirt@hitachi.co.jp", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "hirt@hitachi.co.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[10.2.0,11.0.8)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "Hitachi Ops Center Administrator", "source": "cna", "vendor": "Hitachi"}, "product": "ops_center_administrator", "vendor": "hitachi"}], "analysis": {"en": {"generated_at": "2026-03-25T03:50:30.412207+00:00", "value": {"mitigation_remediation": ["Update Hitachi Ops Center Administrator to version 11.0.8 or later"], "summary": {"action": "Apply Patch", "impact": "Open Redirect for Potential Phishing"}, "threat_synthesis": {"affected_systems": "The affected product is Hitachi Ops Center Administrator. Versions from 10.2.0 up to but not including 11.0.8 are vulnerable. No other vendors or products are listed in the CNA data.", "description_and_impact": "The vulnerability is an improper validation of user\u2011supplied URLs that allows an attacker to craft a link which, when followed by a user, redirects them to an arbitrary external location. This open redirect can be used for phishing campaigns or to trick users into visiting malicious sites, potentially compromising credentials or delivering malware. The weakness is a classic input validation defect classified as CWE\u2011601.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The likely attack path requires an attacker to embed a malicious URL into the application or deliver it through a phishing email. Successful exploitation hinges on user interaction \u2013 the user must click the manipulated link. Once redirected, the user may be exposed to phishing or other malicious content. Given the moderate score and user interaction requirement, the risk is considered moderate but should be mitigated promptly."}}}}, "created": "2026-03-25T11:35:43.156973+00:00", "updated": "2026-03-25T21:15:59.483750+00:00", "vendors": ["hitachi", "hitachi$PRODUCT$ops_center_administrator"]}