CISA 2026-10-06

Hitachi Energy SOI

CVE-2026-34197 +1

Machine-generated analysis · WAYSCloud LLM

SOI versions 2.0.0-2.2.0 contain an ActiveMQ code-injection flaw (CVE-2026-34197).

Context

The advisory concerns Hitachi Energy’s SOI product, versions 2.0.0 through 2.2.0. It reports an improper input validation/code injection vulnerability in the embedded Apache ActiveMQ broker that can lead to remote code execution. The default Jolokia JMX-HTTP bridge permits exec operations on all ActiveMQ MBeans, allowing an authenticated attacker to load a remote Spring XML context and execute arbitrary code.

Operator considerations

Check: Verify that deployed SOI instances are running version 2.0.0-2.2.0.
Isolate: Limit network access to the /api/jolokia/ endpoint to trusted hosts only.
Patch: Apply the SOI EP2 patch, which upgrades ActiveMQ to version 5.19.5.
Log: Monitor for JMX exec operation attempts on ActiveMQ MBeans such as BrokerService.addNetworkConnector.

From Cybersecurity and Infrastructure Security Agency ↗

Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality, integrity, and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

The following versions of Hitachi Energy SOI are affected:

SOI vers:SOI/>=2.0.0|

Read the full advisory on CISA →