CVE-2025-11158: Hitachi Vantara Pentaho Data Integration And Analytics

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.

Affected products

• Hitachi Vantara Pentaho Data Integration And Analytics: before 10.2.0.6 (fixed in 10.2.0.6)

Published 2026-03-10. Last modified 2026-06-17.