CVE-2025-65115 is a remote code execution flaw in Hitachi JP1/IT Desktop Management 2 and JP1/NETM/DM on Windows, scored CVSS 8.8. Hitachi lists fixed versions for the current lines, such as 13-50-03 and 12-60-12, and says there are no workarounds.
What's affected
Hitachi's security information hitachi-sec-2026-118, released 7 April 2026, covers two issues: CVE-2025-65115, remote code execution at CVSS 8.8, and CVE-2025-65116, a buffer overflow at CVSS 5.5. The weakness for the first is CWE-73, external control of a file name or path. The vector is network based, low complexity, with low privileges and no user interaction.
Affected products, all on Windows, are JP1/IT Desktop Management 2 Manager and Operations Director, Job Management Partner 1/IT Desktop Management 2 Manager, JP1/IT Desktop Management Manager, Job Management Partner 1/IT Desktop Management Manager, JP1/NETM/DM Manager and Client, and Job Management Partner 1/Software Distribution Manager and Client. The version ranges are long and reach back through many older releases.
Hitachi lists these fixed versions: for JP1/IT Desktop Management 2 Manager and Operations Director, 13-50-03, 13-11-04, 13-10-07, 13-01-07, 13-00-05 and 12-60-12. For JP1/NETM/DM Manager and Client, 10-30. For other lines, including older releases that the advisory lists as affected, no fixed version is given, and Hitachi says to contact your support representative.
How to check if you're exposed
Find the product and version on each Windows manager and client. Compare with the lists in Hitachi's advisory, which names the affected ranges for each product.
Three outcomes are possible. Your version appears in the affected ranges and has a listed fixed version for its line, so you upgrade to that. Your version is in an affected range for a product with no listed fix, so you contact Hitachi support. Or your version is outside the listed ranges, in which case confirm with Hitachi in writing.
The advisory states that there are no workarounds. Next, check network exposure of the manager. A desktop management server that is reachable by many clients is reachable by many potential attackers, so look at which networks can connect to it.
What to do now
- Inventory all JP1/IT Desktop Management and JP1/NETM/DM installs and their exact versions.
- Upgrade to the fixed version listed for your line, for example 13-50-03 or 12-60-12 for JP1/IT Desktop Management 2 Manager.
- For lines with no listed fix, contact your Hitachi support representative and plan a move to a supported line.
- Restrict network access to the manager so that only managed devices and administrators can connect.
- Review the accounts that can sign in to the manager and remove unused ones.
- Use the same change to cover CVE-2025-65116.
Why it matters
The class is CWE-73, external control of a file name or path. The software lets a request influence which file is read, written or used, and the record says that can end in remote code execution. The advisory describes it as network reachable with low privileges, so a basic account is enough to start.
A management server for desktops is an attractive target. It talks to every managed machine and is trusted by them. Code execution on the manager can be a step toward the whole fleet, which is why software distribution tools are watched closely in many incident reports.
Older product lines are a recurring problem in advisories like this one. Many versions are listed as affected but only some have a fix, so the long term answer is to keep the product on a supported line. The KEV flag is false.
Quick check
Is there a workaround?
No. Hitachi's advisory lists the workarounds as none.
What if my version has no fixed release listed?
Contact your Hitachi support representative, as the advisory instructs.
Sources
Last reviewed: 19 October 2026.
