CVE-2025-9661 is an OS command injection (CVSS 8.1, high) in the management GUI maintenance utility of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28. Hitachi says the permanent action is to replace the microcode with DKCMAIN A3-04-21-40/00 and ESM A3-04-21/00 or later.
What's affected
From the Hitachi security information page (hitachi-sec-2026-309, dated 27 March 2026): Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28 running a version before DKCMAIN A3-04-21-40/00 and ESM A3-04-21/00.
Hitachi lists no interim action. The only listed countermeasure is the microcode replacement.
How to check if you're exposed
- In the storage system maintenance tools, read the installed DKCMAIN and ESM microcode versions.
- Compare them with DKCMAIN A3-04-21-40/00 and ESM A3-04-21/00.
- Ask your Hitachi support contact for the update procedure for your model, since microcode updates are normally planned work.
What to do now
- Identify every VSP One Block system and its microcode version.
- Plan the microcode update with Hitachi support, and schedule it in a maintenance window.
- Until it is applied, restrict network access to the management GUI to a dedicated management network.
- Review access logs of the maintenance utility and the accounts that can reach it.
- Record the update in your change log so audits can see it.
Microcode updates on storage systems are planned work, and they should be. Contact Hitachi support early, since they will want to confirm the target version for your model, the current state of the array and the timing relative to your backups and replication.
Until the update, treat the management interface as a sensitive asset. It should sit on a separate management network, reachable only from administrator workstations or a jump host, with logging turned on. Remove any route to it from user networks or the internet.
After the update, record the DKCMAIN and ESM versions in your asset inventory and keep the Hitachi advisory ID, hitachi-sec-2026-309, in the change record.
Why it matters
The weakness is CWE-78 (OS command injection). A management function builds an operating system command from input that is not properly neutralised. On a storage array, a management plane compromise could affect the data that sits behind it, so the CVSS impact values are high for confidentiality, integrity and availability.
The attack complexity is high in the vector, which holds the score to 8.1. The record does not mark this as exploited, and it is not in the CISA KEV list.
Quick check
Is there a workaround?
Hitachi lists no interim action. Limiting access to the management network reduces exposure but does not remove the flaw.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
