Hitachi Energy SOI

Act NowCVSS 8.8ICS-CERT ICSA-26-279-04Sep 29, 2026

Hitachi EnergyEnergy

Attack path

Attack VectorNetwork

Auth RequiredLow

ComplexityLow

User InteractionNone needed

Summary

Remote Code Execution (RCE) vulnerability in the Apache ActiveMQ component of Hitachi Energy SOI versions 2.0.0 through 2.2.0. The vulnerability allows an authenticated attacker to execute arbitrary code on the SOI Core system by sending a crafted message to the ActiveMQ JMS message broker. This affects the confidentiality, integrity, and availability of the SOI platform. The fix is provided through patch EP2, which upgrades ActiveMQ to version 5.19.5, installs OpenJDK version 11, upgrades SOI management scripts, and updates the ActiveMQ client libraries in the WildFly module.

What this means

What could happen

An attacker with access to the SOI network could run arbitrary code on your SOI Core system via the Apache ActiveMQ message broker, potentially compromising confidentiality of operations data, altering system configuration or process commands, and disrupting availability of the SOI platform.

Who's at risk

Hitachi Energy SOI users, particularly in electric utilities and independent power producers. This affects SOI Core systems that manage monitoring and information services for energy infrastructure, including any deployments that rely on the ActiveMQ message broker for inter-system communications.

How it could be exploited

An attacker with authenticated access to the SOI network can send a crafted message to the ActiveMQ JMS broker on the SOI Core system. The broker processes the message without proper validation and executes embedded code, allowing the attacker to run arbitrary commands on the SOI Core with the privileges of the ActiveMQ service.

Prerequisites

Authenticated access to the SOI network or access to systems that communicate with the ActiveMQ JMS broker port on SOI Core
SOI version 2.0.0 through 2.2.0 running vulnerable ActiveMQ version

remotely exploitablelow complexityactively exploited (KEV)high EPSS score (15.5%)affects control system platform

Exploitability

Actively exploited — confirmed by CISA KEV

Metasploit module available — weaponized exploitView module ↗

Public Proof-of-Concept (PoC) on GitHub (10 repositories)

Affected products (1)

ProductAffected VersionsFix Status

SOI≥ 2.0.0, ≤ 2.2.0Fix available

Remediation & Mitigation

0/3

Do now

0/2

HOTFIXUpdate SOI to patch EP2, which upgrades Apache ActiveMQ to version 5.19.5 and OpenJDK to version 11

WORKAROUNDRestrict network access to the SOI ActiveMQ JMS message broker port to only authorized SOI components and management systems

Long-term hardening

0/1

HARDENINGImplement network segmentation to isolate the SOI Core system from untrusted networks and limit connections to only required SOI client systems

CVEs (1)

CVE-2026-34197

View full CISA ICS-CERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/859cff50-9240-4e9d-a8aa-ed856d4a018a

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.