CVE-2026-86575 in Automatic Job Management System
Summary
by MITRE • 10/27/2026
Stack-based Buffer Overflow Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability represents a critical stack-based buffer overflow within the core components of Fujitsu’s JP1 product suite, specifically affecting versions of JP1/Integrated Management 3 Manager, JP1/Automatic Job Management System 3 Manager and Agent, as well as JP1/Base. This class of software defect occurs when a program writes more data to a fixed-length block of memory on the stack than it is allocated to hold. In the context of enterprise job scheduling and management systems like JP1, such vulnerabilities are particularly dangerous because these applications often run with elevated privileges to execute automated tasks across distributed environments. The affected versions span from release 13-00 up to but not including version 13-50-31 for most components, while the JP1/Base component is vulnerable in releases from 11-00 through 12-50-54. This wide range of impacted software indicates a systemic issue within the underlying codebase that has persisted across multiple major and minor updates until specific patches were applied.
From a technical perspective, stack-based buffer overflows exploit the way memory is managed during function execution. When a program calls a function, it allocates space on the call stack for local variables and control data such as return addresses. If an input parameter exceeds the allocated buffer size without proper bounds checking, the excess data spills over into adjacent memory locations. In severe cases, this overflow can overwrite the saved instruction pointer or frame pointer stored on the stack. An attacker who can trigger this condition by supplying specially crafted input data may gain control over the program's execution flow. By carefully crafting the payload to include shellcode and manipulating the overwritten return address, a remote unauthenticated attacker could potentially execute arbitrary code with the same privileges as the vulnerable process. This capability transforms what might otherwise be a denial-of-service issue into a full system compromise scenario.
The operational impact of this vulnerability is significant for organizations relying on JP1 for critical business automation. Since these systems often manage high-value workflows, database maintenance, and batch processing jobs, unauthorized code execution could lead to the exfiltration of sensitive corporate data, modification or deletion of job schedules, and disruption of essential services. Furthermore, because the affected components include both Manager and Agent architectures, an attacker might target either the central management console or the distributed endpoints where agents reside. Compromising a manager node could allow lateral movement across the entire managed infrastructure, while compromising agent nodes provides direct access to individual servers within the network perimeter. The breadth of versions affected suggests that many organizations may still be running vulnerable software if they have not applied the latest security updates provided by Fujitsu.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-120, which describes buffer copy without checking size limits, and specifically manifests as a stack-based overflow often categorized under CWE-787 in terms of out-of-bounds write effects on memory structures. In the context of the MITRE ATT&CK framework, this flaw facilitates initial access techniques such as T1190 Exploit Public-Facing Application or potentially privilege escalation via T1068 Exploitation for Privilege Escalation if local exploitation is possible. The lack of input validation allows attackers to bypass standard security controls that rely on detecting malformed requests rather than exploiting memory corruption logic directly. Defense-in-depth strategies are compromised because traditional network-level protections may not inspect the content of internal application traffic thoroughly enough to prevent such low-level memory manipulation attacks from succeeding within trusted zones.
Mitigation requires immediate action by system administrators and IT operations teams responsible for maintaining JP1 environments. The primary remediation step is to upgrade all affected components to versions 13-50-31 or later for the Manager, Agent, and Minimal Edition products, and version 12-50-54 or later for JP1/Base. Organizations should verify their current inventory against these version thresholds using automated discovery tools integrated with Fujitsu’s support portal. In addition to patching, it is advisable to implement network segmentation policies that restrict access to the management interfaces of JP1 components to only authorized administrative subnets. Enabling strict logging and monitoring for unusual process behavior or unexpected privilege changes can help detect exploitation attempts in real-time. Security teams should also review application hardening configurations to ensure that stack protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are enabled, although these mitigations alone do not fix the root cause and must be supplemented by code-level fixes via vendor updates.