CVE-2026-2253: Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hitachi Vantara Pentaho Data Integration & Analyticsto a version that resolves this vulnerability.Fixed in 10.2.0.7 - Upgrade
Upgrade
Hitachi Vantara Pentaho Data Integration & Analyticsto a version that resolves this vulnerability.Fixed in 11.0.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2253?
The severity of CVE-2026-2253 is high, rated at 7.7.
How do I fix CVE-2026-2253?
To fix CVE-2026-2253, update Hitachi Vantara Pentaho Data Integration & Analytics to version 10.2.0.7 or 11.0.0.0 or later.
What is the risk associated with CVE-2026-2253?
The risk associated with CVE-2026-2253 is classified as a risk level of 44.
Which versions are affected by CVE-2026-2253?
CVE-2026-2253 affects Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x.
What type of vulnerability is CVE-2026-2253?
CVE-2026-2253 is an improper restriction of XML External Entity reference vulnerability.