CVE-2025-11159

CRITICAL

Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component

Title source: cna

Description

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.

References (1)

Core 1

Core References

https://support.pentaho.com/hc/en-us/articles/39954640408077--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Dependency-on-Vulnerable-Third-Party-Component-Versions-before-10-2-0-7-and-11-0-0-0-Impacted-CVE-2025-11159

Scores

CVSS v3 9.1

EPSS 0.0034

EPSS Percentile 26.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-1395

Status published

Products (3)

hitachi/vantara_pentaho_data_integration_and_analytics < 10.2.0.7

Hitachi Vantara/Pentaho Data Integration and Analytics 1.0 - 10.2.0.7

Hitachi Vantara/Pentaho Data Integration and Analytics 1.0 - 11.0

Published May 13, 2026

Tracked Since May 13, 2026