Hitachi Energy SOI: 1 CVE, High 8.8
Summary
CISA reports 1 vulnerability in Hitachi Energy SOI. Weakness type: Improper Control of Generation of Code ('Code Injection'). Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality, integrity, and availability of the product. Highest CVSS v3 score: 8.8 (High), exploitable over the network. At least one CVE is on CISA's Known Exploited Vulnerabilities list.
At a glance
- Vendor
- Hitachi Energy
- Products
- SOI
- CVEs
- CVE-2026-34197
- Highest CVSS v3
- 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- Yes
- Sectors (per CISA)
- Energy
- Deployed
- Worldwide
- Vendor HQ
- Switzerland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-34197 | Improper Control of Generation of Code ('Code Injection') | 8.8 | – | Yes (added 2026-04-16) | CVE-2026-34197 |
Affected products (1)
- SOI Version 2.0.0 to 2.2.0
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Apply the patch SOI EP2, which upgrades the ActiveMQ version (JMS message broker) for the SOI Core to version 5.19.5. EP2 is a cumulative patch that covers previous EP1 patch. EP2 also upgrades the SOI management scripts to the latest version and installs an upgraded OpenJDK version 11 to run ActiveMQ MESSAGE BROKER in the newer JRE. It also upgrades the ActiveMQ client libraries installed in the WildFly module.
- Mitigation: Follow General Mitigation Factors/Workarounds and refer to the product deployment guidelines for securing the product environment.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-279-04
- Machine-readable CSAF record
- https://publisher.hitachienergy.com/preview?DocumentID=8DBD000235&LanguageCode=en&Document
- https://publisher.hitachienergy.com/preview?DocumentID=8DBD000244&LanguageCode=en&Document
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.