Is CVE-2022-43769 (Hitachi Vantara Pentaho BA Server Special Element Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2022-43769 to its Known Exploited Vulnerabilities catalogue on 3 March 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.

How CISA’s KEV listing changes the answer

The practical significance is not the CVE label alone, it is the shift from theoretical vulnerability to confirmed exploitation. A KEV listing means defenders should treat the issue as an active exposure path, not as a backlog item to fold into routine patch cycles. For exploited vulnerabilities, prioritisation is driven by exposure and attackability, not by abstract severity scoring alone.

That is why the first question is always where the vulnerable Pentaho BA Server instance sits, who can reach it, and whether it is internet-facing or reachable through a trusted application path. If it is exposed, the risk is immediate because exploitation has already been observed and the attacker does not need a new research breakthrough to attempt it.

For current exploitation status and remediation timing, compare the vendor advisory with the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database. Those sources are the right place to verify product scope, advisory details and the current remediation expectation for the exact deployment you run.

What to do when patching must wait

If you cannot remediate immediately, the goal is to shrink the reachable attack surface and raise the cost of exploitation. For this kind of injection flaw, that usually means restricting access to the server, removing unnecessary network paths, and monitoring for requests that resemble template injection or unexpected command execution attempts. Compensating controls are temporary, so they should be explicit and time-bound rather than treated as a substitute for fixing the vulnerable component.

Where the platform supports it, isolate the server from untrusted users and segment it away from higher-value systems. If the application is reachable from a reverse proxy, load balancer or VPN, validate whether those controls still allow the vulnerable endpoint to be invoked by any authenticated user, internal user or partner integration. The practical question is not just “is it exposed?” but “who can still trigger the vulnerable code path?”

For the attack class itself, use the Web Application Attacks Guide and the OWASP Top 10 to anchor validation and containment around injection patterns rather than treating the CVE as a one-off exception. In this case, the material issue is that injected template content can turn into code execution, so front-end filtering alone is rarely a sufficient answer.

How to look for prior compromise and reduce follow-on impact

Because the vulnerability can lead to arbitrary command execution, post-exploitation review matters as much as patching. Check web and application logs for anomalous requests to the BA Server, unusual template-related input, child processes spawned by the server process, new scheduled tasks, and outbound connections that do not fit normal application behaviour. If the server handled credentials, tokens, configuration files or service account material, treat those assets as potentially exposed during the same incident window.

That investigation should extend beyond the application host. Look for lateral movement, new admin access, suspicious archive creation, and any evidence that an attacker used the server as a launch point into adjacent systems. A server-side execution flaw is often exploited for persistence or credential theft first, then used to widen access after the initial foothold is established.

For prioritisation and verification discipline, the Vulnerability Management Guide and the FIRST EPSS help teams keep this class of issue in the “verify, scope and act” bucket rather than the “track for later” bucket. A confirmed exploitation signal should push the remediation clock forward, while evidence of suspicious activity should trigger compromise assessment rather than simple patch closure.

Risk and Threat Considerations

Confirmed exploitation changes the threat model: the question is no longer whether the flaw could be abused, but whether an attacker is already using it to gain command execution on exposed servers. That raises the likelihood of follow-on actions such as persistence, data access, credential capture or movement into connected systems.

Failure mechanism: The application accepts specially crafted input that reaches a template-processing path, allowing attacker-controlled content to execute as commands on the server.

Impact: A successful exploit can give an attacker direct operating-system level control over the host, which can in turn expose adjacent applications, stored data and any secrets available to the service account.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes rapid vulnerability triage and remediation central to this CVE.
Recommendation — Prioritize, validate, and remediate the affected server before routine patch queues.
NIST CSF 2.0	DE.CM-09 — Monitoring for Unauthorized Personnel, Connections, Devices, and Software	Exploit monitoring and compromise hunting are needed when a KEV-listed flaw may already be abused.
Recommendation — Monitor the server for abnormal connections and unauthorized execution indicators.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue requires timely remediation of a known exploited software flaw.
	AU-2 — Event Logging	Post-exploitation review depends on logging of requests and process activity around the server.
Recommendation — Remediate the vulnerable application promptly and track exceptions until closure. Log application and host events needed to detect abuse and support forensics.
OWASP ASVS	V16 — Security Logging and Error Handling	Detecting abuse of injection paths depends on logging and observable error handling.
Recommendation — Verify logging captures anomalous requests and execution-related failures.

Practitioner Guidance

What to prioritise: Treat exposed instances as urgent until you have confirmed version scope, network reachability and a rollback or mitigation path. If the server is internet-facing or reachable from broad internal networks, move remediation ahead of normal patch queues.

What to verify: Confirm whether any logged-in user, integration account or administrative workflow can still reach the vulnerable endpoint after compensating controls are applied. Verify that the host is not spawning unexpected child processes and that outbound connections match normal business use.

Decision rule: If you find signs of command execution, unusual process creation or suspicious outbound activity, shift from vulnerability response to incident response and preserve evidence before making disruptive changes.

Practitioner takeaway: For exploited vulnerabilities, the right question is not “is there a patch?” but “have we already lost control of the host, and can we prove otherwise?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org