CISA 2026-10-06

Hitachi Energy Asset Suite

Machine-generated analysis · WAYSCloud LLM

Asset Suite versions 9.9.0 and earlier allow unauthenticated access to the HTTPPublishAdapterTestServlet. Upgrade to 9.9.1 or disable the servlet to mitigate.

Context

The advisory concerns Hitachi Energy Asset Suite, a software product referenced for the energy sector. Versions 9.9.0 and prior are vulnerable to unauthenticated access of the HTTPPublishAdapterTestServlet, which can be used to upload configuration files and compromise confidentiality and integrity. The servlet is intended for testing in non-production environments, suggesting it may be unnecessary in live deployments.

Operator considerations

Check: Verify the installed Asset Suite version is 9.9.0 or earlier.
Isolate: Disable the HTTPPublishAdapterTestServlet (and review related servlets) in production.
Patch: Apply the vendor-provided update to Asset Suite 9.9.1 when available.
Log: Monitor HTTP requests to the servlet endpoints for unexpected access attempts.

From Cybersecurity and Infrastructure Security Agency ↗

Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause confidentiality, integrity and availability impact on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

The following versions of Hitachi Energy Asset Suite are affected:

Asset Suite vers:Asset_Suite/

Read the full advisory on CISA →