PT-2026-43483 · Hitachi Vantara · Pentaho Data Integration & Analytics

Dan Begey · Published 2026-05-27 · Updated 2026-06-18 · CVE-2026-2253

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.7 Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 11.0.0.0

Description Certain XML parsers do not prevent the resolution of external entities. This is an improper restriction of XML External Entity (XXE) references, where an XML External Entity is a mechanism that allows an XML document to include content from an external source.

Recommendations Update to version 10.2.0.7 or later. Update to version 11.0.0.0 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2026-08642

CVE-2026-2253

Affected Products

Pentaho Data Integration & Analytics

References · 6

• https://bdu.fstec.ru/vul/2026-08642 · Security Note
• https://support.pentaho.com/hc/en-us/articles/45677548193933--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-10-2-0-7-and-11-0-0-0-Impacted-CVE-2026-2253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2253 · Security Note
• https://t.me/cveNotify/170560 · Telegram Post
• https://t.me/CVEtracker/55070 · Telegram Post
• https://t.me/cveNotify/164790 · Telegram Post