CVE-2025-1978 is a high severity remote code execution flaw (CVSS 8.3) in Hitachi Storage Navigator and the maintenance console on many Virtual Storage Platform arrays. Hitachi's permanent action is to replace the microcode with the fixed versions it lists, and it names no interim workaround.
What's affected
Hitachi's security information page (ID hitachi-sec-2026-307) lists these affected products:
- Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F700 and F900.
- Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H and E1090H.
- Hitachi Virtual Storage Platform One Block 23, One Block 24, One Block 26 and One Block 28.
The permanent action is to replace the microcode with a modified version. Hitachi lists these fixed versions:
- DKCMAIN 88-08-16-xx/00 with SVP 88-08-18-xx/00
- DKCMAIN 93-07-26-xx/00 with SVP 93-07-26-xx/00
- DKCMAIN 93-06-88-xx/00 with SVP 93-06-88-xx/00
- DKCMAIN A3-04-02-xx/00 with MPC A3-04-02-xx/00
- DKCMAIN A3-03-41-xx/00 with MPC A3-03-41-xx/00
- DKCMAIN A3-03-03-xx/00 with MPC A3-03-03-xx/00
The page does not say which model uses which line, so match your array to the correct row using Hitachi's guidance. The interim action is listed as none. Hitachi published the page on 27 March 2026 and added the version information on 16 September 2026.
How to check if you're exposed
Look up the microcode version of each array in Storage Navigator or the maintenance console, or ask the team that manages the storage. Compare the DKCMAIN and SVP or MPC versions against the list in Hitachi's page for your model line.
An array running a version older than the fixed one in its own line is affected. Because the page names several lines and does not map them to models in the text I could read, confirm the mapping with Hitachi support or the full advisory before you decide.
Then check network exposure. Storage management interfaces and maintenance consoles should be reachable only from a dedicated management network. Check firewall rules and any remote support connections to the array.
What to do now
- List every Virtual Storage Platform array and its microcode versions.
- Match each to the right fixed line in Hitachi's advisory and schedule the microcode replacement with your storage team or Hitachi support.
- Limit Storage Navigator and maintenance console access to a dedicated management network.
- Review accounts that can sign in to the management software and remove unused ones.
- Record the new version after the update and keep the advisory ID with the change ticket.
Why it matters
The record lists CWE-94, Code Injection. Management software that builds code or commands from input can be steered into running something its authors did not intend. The record calls the result a remote code execution vulnerability in the Storage Navigator software and the maintenance console.
The CVSS vector is 8.3 with a network path, no privileges and no user interaction, and a changed scope, which means the effect can reach beyond the vulnerable component. It is not listed in CISA's Known Exploited Vulnerabilities catalog per the record, and Hitachi's page does not mention exploitation. Storage arrays hold the data of everything else, so management access deserves the strongest isolation you can give it.
Quick check
Is there a workaround?
Hitachi lists the interim action as none. The permanent action is the microcode replacement.
Where do I find the version?
In Storage Navigator or the maintenance console, or from the storage team. Compare DKCMAIN and SVP or MPC values against Hitachi's list.
Sources
Last reviewed: 19 October 2026.
