CVE-2025-11159

Critical · 9.1

CVSS

9.1

EPSS

0.3%

Published

May 13, 2026

CISA due date

—

The record

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.

Affected packages

Ecosystem	Package	Introduced	Fixed