CVE-2026-71375

Executive Summary

CVE-2026-71375 is an improper restriction of XML external entity (XXE) reference vulnerability affecting the Hitachi Cosminexus Component Container, a Java enterprise application server component. The flaw affects a broad range of versions spanning from 09-00 through 11-70-03, permitting a network-based attacker to trigger XXE processing without requiring authentication. Successful exploitation results in high confidentiality impact (information disclosure) and high availability impact (potential denial of service), while integrity remains unaffected per the CVSS vector. As of this report, no patch is available from any tracked source and no public exploit code has been identified.

Technical Analysis

The vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference), which falls within the broader XML External Entity (XXE) injection vulnerability class. The affected component, Hitachi Cosminexus Component Container, is an Enterprise JavaBeans (EJB) and web application container that processes XML data as part of normal application operation.

XXE vulnerabilities arise when an XML parser is configured with external entity resolution enabled and does not properly restrict the document type definition (DTD) processing. When the application parses XML input—such as SOAP messages, configuration files, or data exchanged with clients—an attacker who can supply a crafted XML document can cause the parser to resolve external entities. These external entities can reference:

1. Local file system resources — using file:// URIs to read arbitrary files from the server
2. Internal network resources — using http:// or ftp:// URIs to perform Server-Side Request Forgery (SSRF)
3. System resources — using file:///dev/random or similar references to cause resource exhaustion

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H) reveals important characteristics of the vulnerability:

• Attack Vector: Network (AV:N) — The vulnerability is remotely exploitable over the network without any special access requirements.
• Attack Complexity: High (AC:H) — Successful exploitation requires conditions that are somewhat difficult to control, suggesting that the attacker may need to win a race condition, overcome parser-specific mitigations, or target specific parsing paths. This could indicate that while the XML parser is vulnerable, certain conditions (e.g., specific parser configuration, application-specific XML processing flows) must be met for successful exploitation.
• Privileges Required: None (PR:N) — No authentication or user privileges are needed to trigger the vulnerability.
• User Interaction: None (UI:N) — The victim application or user does not need to perform any action beyond normal application operation.
• Confidentiality Impact: High (C:H) — Successful exploitation can lead to complete disclosure of sensitive information, including local files, credentials, or internal network data.
• Availability Impact: High (A:H) — The vulnerability can also lead to denial of service, consistent with XXE resource exhaustion attacks (e.g., the "Billion Laughs" attack or recursive entity expansion consuming server memory/CPU).

The specific vulnerable parsing path within the Component Container is not described in sufficient detail in the available NVD entry. The affected version ranges span over a decade of releases (from 09-00 series released circa 2011 through 11-70 released circa 2021), suggesting the vulnerable XML parser configuration was carried forward through multiple major and minor releases without correction. The fact that the vulnerability is grouped across both 09-xx (legacy) and 11-xx (current) series indicates a foundational flaw in the XML processing configuration inherited across the product generation.

Hitachi Cosminexus is widely deployed in Japanese enterprise environments—particularly within financial services, government agencies, and telecommunications—where it serves as the primary application server for mission-critical systems such as online banking, electronic government services (e-Government), and core enterprise transactional systems.

Exploitation Scenarios

Because no public PoC or exploit code exists and the NVD description lacks specific technical implementation details, the attack chain below is inferred from the XXE vulnerability class and the CVSS vector. The attack scenarios respect the constraint that no specific function names, endpoints, or payload structures are known from public information.

Scenario 1: Information Disclosure via Crafted SOAP/XML Message

Step 1 — Reconnaissance/Target Identification: An attacker performs network scanning to identify servers running Cosminexus Component Container by examining HTTP response headers (which often advertises server product information such as "Server: Cosminexus" or similar), TLS certificate subject fields, or by fingerprinting distinctive error pages and HTTP headers associated with the Java application server stack. Shodan queries using product keywords such as "Cosminexus" can identify internet-facing instances. Given the CVSS vector indicates network-based attack and no authentication requirement, the target must expose an XML-processing endpoint—likely a SOAP web service or REST API that accepts XML payloads—without requiring authentication for that particular operation.

Step 2 — Triggering the Flaw: The attacker identifies an application endpoint that accepts XML input. Because this is an XXE in the component container itself (rather than a specific application), the vulnerability likely affects system-level XML parsing services—potentially JAXP-based document builders used for service deployment descriptors, configuration parsing, or message handling. The attacker crafts an HTTP request containing a SOAP envelope or XML document with a malicious DOCTYPE declaration. The high attack complexity suggests manual manipulation of the parser state or targeting of specific XML processing contexts may be needed, possibly involving XML content that reaches the vulnerable parser path through chained or nested document processing.

Step 3 — Payload/Execution at Vulnerability-Class Level: The attacker embeds an external entity reference using the standard XXE pattern:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

Because the parser fails to restrict external entity resolution, when the parser encounters the entity reference &xxe;, it retrieves the content of /etc/passwd (or another target file) and includes it in the parsed XML document. If the application echoes back the parsed content in an error message or response body, the attacker retrieves the file contents. Alternatively, the attacker may use an out-of-band (OOB) exfiltration technique by making the entity reference point to an attacker-controlled server that receives the file contents as an HTTP GET parameter, enabling data retrieval even when successful parsing does not produce a visible echo.

Step 4 — Post-Exploitation Impact: Successful exploitation yields high confidentiality impact: the attacker can read arbitrary local files from the application server, including configuration files containing database credentials, deployment descriptors, keystore files, environment variables, and potentially sensitive data mounted on the server filesystem. This can pivot toward broader credential-based compromise of backend databases or internal services.

Scenario 2: Denial of Service via Entity Expansion

Step 1 — Reconnaissance/Target Identification: The attacker identifies the XML-processing endpoint as described in Scenario 1. However, in this scenario, the attacker uses automation (e.g., a simple HTTP client script) to repeatedly deliver malicious payloads to the service.

Step 2 — Triggering the Flaw: The attacker sends XML documents containing billion-laughs-style nested entity declarations:

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  ...
]>
<root>&lol999;</root>

Alternatively, the attacker uses external entity amplification by pointing to a large remote file or a slow network resource.

Step 3 — Payload/Execution: As the parser recursively expands the nested entities, memory and CPU consumption grow exponentially, potentially exhausting the JVM heap, causing OutOfMemoryError conditions and effectively terminating the affected component or server process.

Step 4 — Post-Exploitation Impact: The denial of service persists until the application server is restarted or fails over. The CVSS availability impact of High suggests that this attack can render the Component Container unavailable, impacting all applications deployed upon it.

Scenario 3: Internal Network Reconnaissance (SSRF-Driven XXE)

Step 1: The attacker identifies the XML-processing endpoint as above. Step 2: The attacker crafts XML with an external entity pointing to internal IP addresses and ports:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://192.168.1.10:8080/admin">
]>
<root>&xxe;</root>

Step 3: The server, upon parsing the document, makes an HTTP request to the internal URL specified. Timeouts, error messages, or OOB callbacks to attacker-controlled infrastructure reveal whether the internal port/service is open. Step 4: This information maps internal network topologies, identifies available management consoles (e.g., database admin panels, internal admin UIs), and can enable subsequent targeted attacks against those discovered services.

Note: No public exploit code or PoC exists for this vulnerability. The exploitation methods described above are generalized techniques applicable to the XXE vulnerability class and are presented as plausible attack chains. Real-world exploitation may vary based on application-specific XML handling logic.

Impact Assessment

The CVSS score of 7.4 (High severity) reflects a vulnerability with substantial business impact across both confidentiality and availability dimensions:

• Confidentiality impact is High (C:H) — An unauthenticated remote attacker can read arbitrary files on the affected server with the privileges of the Java application server process. Given that Cosminexus typically runs under a dedicated service account with access to application configuration files, database credentials, and system information, this constitutes a severe information disclosure risk. In regulated sectors where Cosminexus is deployed (Japanese banking, government, telecommunications), exposure of customer data or system credentials could trigger regulatory breach-notification obligations under Japan's Act on the Protection of Personal Information (APPI) or sector-specific regulations.

• Availability impact is High (A:H) — The attack can disrupt operations of mission-critical application servers. For organizations running online banking or e-Government services on Cosminexus, availability disruptions translate directly into lost transactional capacity, service-level agreement violations, and operational costs.

• Integrity impact is None (I:N) — The vulnerability class does not directly permit data modification or system integrity compromise.

The broad affected version range (09-00 through 11-70-03, spanning potentially 10+ years of releases) means that virtually any deployed Cosminexus Component Container that has not received a forthcoming patch is exposed. However, the high attack complexity (AC:H) tempers the practical risk—specific conditions must align for exploitation, potentially limiting the attack surface to specific XML processing configurations. Organizations that do not expose XML-accepting endpoints to unauthenticated network users may have a lower effective exposure.

Hitachi Cosminexus is a commercial product sold primarily in Japan under a subscription model. As of this report, no vendor patch, advisory, or mitigation guidance exists for CVE-2026-71375 across any tracked source. No CISA KEV listing and no known exploitation in the wild has been reported.

Detection Guidance

The following detection content is built around the XXE vulnerability class and general XML-malicious traffic patterns, since no specific exploit signatures exist for this CVE.

Sigma Rule

title: Potential XXE Exploitation Attempt Against XML Processing Services
id: 686ff2ca-3f9c-4b1a-9c5e-df3a1c8f6b2d
status: experimental
description: Detects HTTP requests containing XML external entity indicators targeting application servers
author: Valtersit Cyber Threat Intelligence
date: 2026/02/15
logsource:
  category: webserver
  product: generic
detection:
  selection_xml_body:
    http.body|contains|all:
      - '<?xml'
      - '<!DOCTYPE'
      - 'SYSTEM'
      - 'file://'
  selection_internal_uri:
    http.body|contains|any:
      - 'file:///etc/passwd'
      - 'file:///etc/shadow'
      - 'file:///c:/windows/'
      - 'file:///home/'
  selection_entity_doctype:
    http.body|contains|any:
      - '<!ENTITY'
      - 'xsi:schemaLocation'
      - '&#x25;'
  selection_user_agent:
    http.user_agent|contains:
      - 'curl'
      - 'python-requests'
      - 'wget'
  condition: selection_xml_body and (selection_internal_uri or selection_entity_doctype) or (selection_xml_body and selection_user_agent)
  timeframe: 5m
fields:
  - src_ip
  - dest_ip
  - http.url
  - http.user_agent
falsepositives:
  - Legitimate XML configuration tools that reference external DTDs or schemas
  - Development/testing tools that intentionally resolve external entities
  - XML-based web services (SOAP, REST) where client-side entity references are expected
level: high
tags:
  - attack.t1190
  - attack.t1005
  - cwe.611
  - cve.2026.71375
  - xxe

YARA Rule

rule CVE_2026_71375_XXE_Cosminexus
{
    meta:
        author = "Valtersit Cyber Threat Intelligence"
        description = "Detects XML payloads containing XXE indicators targeting Cosminexus Component Container"
        date = "2026-02-15"
        reference = "CVE-2026-71375"
        cve = "2026-71375"
        severity = "high"
        tags = "xxe", "cwe-611", "hitachi", "cosminexus"
    strings:
        $xml_decl = "<?xml" ascii wide nocase
        $doctype = "<!DOCTYPE" ascii wide nocase
        $entity = "<!ENTITY" ascii wide nocase
        $system = "SYSTEM" ascii wide nocase
        $public = "PUBLIC" ascii wide nocase
        $file_uri = "file://" ascii wide nocase
        $http_uri = "http://" ascii wide nocase
        $entity_ref_amp = "&xxe;" ascii wide nocase
        $entity_ref_ent = "&entity" ascii wide nocase
        $local_file = "/etc/passwd" ascii wide nocase
        $local_file2 = "/etc/shadow" ascii wide nocase
        $windows_file = "c:\\windows" ascii wide nocase
        $percent_entity = "%25" ascii wide nocase
    condition:
        uint16(0) == 0x3C3F or $xml_decl
        and $doctype
        and 2 of ($system, $public, $file_uri, $http_uri, $entity)
        or ($xml_decl and $doctype and $entity_ref_amp)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-71375 - Potential XXE Exploitation Against Cosminexus Component Container"; flow:established,to_server; content:"<?xml"; http_client_body; nocase; content:"<!DOCTYPE"; http_client_body; nocase; distance:0; content:"SYSTEM"; http_client_body; nocase; distance:0; content:"file://"; http_client_body; nocase; distance:0; classtype:attempted-admin; sid:202671375; rev:1; metadata:cve 2026-71375, cwe 611, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public-Facing_Application;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-71375 - XXE External Entity Reference in Request Body"; flow:established,to_server; content:"<!ENTITY"; http_client_body; nocase; content:"SYSTEM"; http_client_body; nocase; content:"&#x25;"; http_client_body; nocase; classtype:attempted-admin; sid:202671376; rev:1; metadata:cve 2026-71375, cwe 611;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-71375 - Suspicious XXE Payload Indicators (file access or internal IP reference)"; flow:established,to_server; pcre:"/<\?xml[^>]*<!DOCTYPE[^>]*(file:\/\/|http:\/\/1?[0245679]{1,2}\.|192\.168\.|10\.\d{1,3}\.|172\.(1[6-9]|2[0-9]|3[01])\.)/is"; http_client_body; classtype:attempted-admin; sid:202671377; rev:1; metadata:cve 2026-71375, cwe 611, mitre_technique_id T1090, mitre_technique_name Connection_Proxy;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-71375 - Billion Laughs Entity Expansion Attempt"; flow:established,to_server; content:"<!ENTITY"; http_client_body; nocase; content:"lol"; http_client_body; nocase; within:50; content:"lol2"; http_client_body; nocase; within:100; classtype:attempted-dos; sid:202671378; rev:1; metadata:cve 2026-71375, cwe 611, mitre_technique_id T1499, mitre_technique_name Endpoint_Denial_of_Service;)

Elastic Detection

GET /_search
{
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "filter": [
              {"term": {"event.category": "web"}},
              {"bool": {"must": [{"match_phrase": {"http.request.body.content": "<?xml"}}]}},
              {"bool": {"must": [{"match_phrase": {"http.request.body.content": "<!DOCTYPE"}}]}},
              {"bool": {"should": [
                {"match_phrase": {"http.request.body.content": "SYSTEM"}},
                {"match_phrase": {"http.request.body.content": "file://"}},
                {"match_phrase": {"http.request.body.content": "http://"}},
                {"match_phrase": {"http.request.body.content": "PUBLIC"}},
                {"match_phrase": {"http.request.body.content": "<!ENTITY"}}
              ], "minimum_should_match": 1}}
            ]
          }
        },
        {
          "bool": {
            "filter": [
              {"term": {"event.category": "web"}},
              {"bool": {"should": [
                {"wildcard": {"http.request.body.content": "*file:///etc/passwd*"}},
                {"wildcard": {"http.request.body.content": "*file:///etc/shadow*"}},
                {"wildcard": {"http.request.body.content": "*file:///c:/windows/*"}},
                {"wildcard": {"http.request.body.content": "*</ENTITY lol*"}}
              ], "minimum_should_match": 1}}
            ]
          }
        }
      ],
      "minimum_should_match": 1
    }
  }
}

// Alternative EQL correlation — detection of outbound SSRF initiated by server after XXE payload
sequence by host.name with maxspan=30s
  [ network where event.action == "connection_attempted" and 
    destination.ip != source.ip and 
    process.name : "java" and 
    network.protocol : "tcp" and 
    destination.port : 80 or destination.port : 8080 or destination.port : 443 ]

Note: The EQL above is illustrative. For a production Elastic SIEM you would more realistically search HTTP access logs for base64-encoded or raw XXE markers in request bodies as shown in the first query.

Splunk SPL Query

index=web OR index=proxy OR sourcetype="access_combined_wcookie" OR sourcetype="iis"
| where like(_raw, "%<?xml%") AND like(_raw, "%<!DOCTYPE%")
| eval is_xxe=if(
    like(_raw, "%SYSTEM%") OR 
    like(_raw, "%PUBLIC%") OR 
    like(_raw, "%file://%") OR 
    like(_raw, "%<!ENTITY%") OR 
    like(_raw, "%http://%"), 1, 0)
| where is_xxe=1
| eval file_indicator=if(
    like(_raw, "%/etc/passwd%") OR 
    like(_raw, "%/etc/shadow%") OR 
    like(_raw, "%C:\\Windows%") OR 
    like(_raw, "%/home/%"), 1, 0)
| eval suspicious_ua=if(
    like(user_agent, "%curl%") OR 
    like(user_agent, "%python-requests%") OR 
    like(user_agent, "%wget%") OR 
    like(user_agent, "%nikto%") OR 
    like(user_agent, "%sqlmap%"), 1, 0)
| eval severity_score = (file_indicator * 3) + (suspicious_ua * 1) + 1
| where severity_score >= 3
| table _time, src_ip, dest_ip, src_port, dest_port, method, uri, user_agent, severity_score
| sort - _time
| rex field=_raw "^(?<http_version>\S+)\s+(?<status>\d+)\s+(?<bytes>\d+)"
| stats count by src_ip, dest_ip, uri, user_agent, status
| sort - count

Additional Splunk query for success confirmation:

index=web
| rex field=_raw "^.*\" (?<http_status>\d+) .*$"
| where http_status >= 200 AND http_status < 300
| search "<?xml" "<!DOCTYPE" "SYSTEM"
| table _time, src_ip, clientip, status, method, uri
|  stats by src_ip, status

Wazuh OSSEC Rule

<group name="web,xxe,cve-2026-71375,">
  <!-- Rule 1: Detect XXE payload markers in HTTP requests to web servers -->
  <rule id="100675" level="12">
    <if_sid>31122</if_sid>
    <match>SYSTEM "file://</match>
    <description>Possible XXE injection attempt targeting Cosminexus Component Container (CVE-2026-71375)</description>
    <group>web_application_attack,xxe,cwe_611,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <!-- Rule 2: Detect DOCTYPE + ENTITY combination indicative of XXE -->
  <rule id="100676" level="12">
    <if_sid>31122</if_sid>
    <match>DOCTYPE</match>
    <regex>\<\!DOCTYPE\s+\w+\s+\[</regex>
    <regex>\<\!ENTITY</regex>
    <description>Detected DOCTYPE declaration with embedded ENTITY—possible XXE attempt (CVE-2026-71375)</description>
    <group>web_application_attack,xxe,cwe_611,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <!-- Rule 3: Detect requests for sensitive system files via file:// URI inside XML -->
  <rule id="100677" level="14">
    <if_sid>100675</if_sid>
    <match>file:///etc/passwd</match>
    <match>file:///etc/shadow</match>
    <match>file:///windows/</match>
    <description>XXE attempt reading system files from server (CVE-2026-71375)</description>
    <group>web_application_attack,xxe,credential_access,cwe_611,</group>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>

  <!-- Rule 4: Detect generic "Billion Laughs" expansion pattern -->
  <rule id="100678" level="10">
    <if_sid>31122</if_sid>
    <regex>\&lol\d+\;lol\d+\;</regex>
    <description>Potential Billion Laughs entity amplification attempt (CVE-2026-71375)</description>
    <group>web_application_attack,xxe,dos,cwe_611,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Critical notice: Patch confidence is 0/4 (UNPATCHED). No patch evidence exists from any tracked source. The vendor has neither confirmed the vulnerability nor released an advisory or fix at the time of this report. Because no workarounds have been published by the vendor, the following recommendations are based on generic XXE mitigation best practices.

1. Immediate Mitigations (Defense-in-Depth while awaiting vendor patch)

• Restrict network access — Limit access to XML-processing endpoints on affected Cosminexus servers to trusted networks only using firewall rules or network segmentation. This reduces the attack surface to internal threats rather than external attackers.
• Deploy a WAF (Web Application Firewall) — Use ModSecurity (OWASP Core Rule Set), AWS WAF, F5 ASM/Advanced WAF, or similar to filter HTTP requests containing <DOCTYPE, <!ENTITY, SYSTEM, or file:// patterns in request bodies. The CRS rules 203101 through 203115 specifically target XXE injection attempts.
• Monitor XML-driven traffic aggressively — Enable logging on web proxies, reverse proxies, and application servers, and alert on XML requests containing DOCTYPE declarations, especially those from unusual source IPs or with unusual User-Agent strings.
• Apply generic Java XML parser security settings where possible — If the Cosminexus environment allows administrator access to configuration files (struts-config, web.xml, or system properties), attempt to set JAXP properties such as XMLConstants.ACCESS_EXTERNAL_DTD and XMLConstants.ACCESS_EXTERNAL_SCHEMA to empty strings. This can potentially neutralize the XXE vector at the Java security layer, but carries risk of breaking legitimate XML/XSD-based functionality.

2. Patch/Upgrade Steps

• Monitor Hitachi's official support portal at https://www.hitachi.co.jp/Prod/comp/soft1/cosminexus/index.html and the Hitachi Vulnerability Information page for announcements regarding CVE-2026-71375.
• Subscribe to Hitachi security advisory mailing lists or RSS feeds to receive immediate notification when the vendor publishes patches.
• Test and deploy any vendor-provided patch on a staging environment replicating production Cosminexus configurations before pushing to production. Validate all applications deployed on the Component Container for regressions in XML parsing behavior.
• If the threat is deemed exploitable in your environment, consider establishing a risk acceptance memo documenting that the system is exposed until the vendor issues a fix.

3. Long-Term Hardening

• Replace or decommission End-of-Life Cosminexus versions (09-xx series especially are legacy) where possible, migrating to modern, actively maintained versions that receive prompt security fixes.
• Retrofit the architecture by placing all XML-consuming endpoints behind an API gateway or ESB that can enforce strict schema validation and reject DOCTYPE declarations outright.
• Implement layered output filtering on reverse proxies so that even if an XXE attack succeeds, the response body is scrubbed of sensitive file-content signatures.
• Involve vendor — Directly engage Hitachi support to request mitigation guidance and patch ETA for this specific CVE. Enterprise customers with support contracts should escalate this finding given the broad version range affected.
• Secure development review for all in-house applications deployed on Cosminexus to ensure they use parameterized XML parsers (e.g., DocumentBuilderFactory with setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)).

References

1. National Vulnerability Database (NVD) — CVE-2026-71375: https://nvd.nist.gov/vuln/detail/CVE-2026-71375
2. MITRE ATT&CK — Exploit Public-Facing Application (T1190): https://attack.mitre.org/techniques/T1190/
3. CWE-611 — Improper Restriction of XML External Entity Reference: https://cwe.mitre.org/data/definitions/611.html
4. Hitachi Cosminexus Product Page (Japanese): https://www.hitachi.co.jp/Prod/comp/soft1/cosminexus/index.html
5. OWASP XXE Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

No known threat-actor campaigns or exploit-in-the-wild activity has been identified for CVE-2026-71375 as of this report's publication. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Organizations should nevertheless remain alert, as the absence of public exploit code does not preclude internal or targeted exploitation, particularly given that Hitachi Cosminexus serves critical Japanese industrial and government sectors.