CVE-2026-2253
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
Risk Assessment
An attacker could exploit this vulnerability to read files on the server, perform an SSRF attack, or cause a denial of service.
Recommendation
Update Hitachi Vantara Pentaho to version 10.2.0.7, 11.0.0.0, or later.
Other vulnerabilities in Hitachi Vantara Pentaho
See all- CVE-2026-2255Medium
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0 (including 9.3.x and 8.3.x) expose Hadoop cluster credentials in plain text through the Cluster Test API. Users can leverage these credentials to submit jobs via the backend API.
- CVE-2026-2254Medium
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, do not apply ACLs on certain API endpoints related to platform mail notifications.
Original NVD description (English source)
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.