By Homeland Threat Watch News Desk
Hitachi Energy SOI versions 2.0.0 through 2.2.0 contain a high-severity vulnerability that can allow an authenticated attacker to execute arbitrary code on the product’s Apache ActiveMQ broker, the Cybersecurity and Infrastructure Security Agency said in an ICS advisory republishing Hitachi Energy’s security notice.
The vulnerability, tracked as CVE-2026-34197, carries a CVSS 3.1 base score of 8.8, rated high. The advisory says exploitation could affect the confidentiality, integrity and availability of SOI. The product is identified as used in the energy sector, with deployments worldwide, and the affected product status is listed as “known_affected.”
The flaw is in Apache ActiveMQ Classic, the JMS message broker used by SOI. The broker’s web console exposes a Jolokia JMX-HTTP bridge at /api/jolokia/. According to the advisory, the default Jolokia access policy permits execution operations on ActiveMQ management objects, including operations that can add network connectors and connectors to the broker.
An authenticated attacker can invoke those operations with a crafted discovery uniform resource identifier. The request can cause ActiveMQ’s virtual-machine transport to load a remote Spring XML application context through ResourceXmlApplicationContext. The loading process instantiates singleton beans before the broker validates the configuration. The advisory says that sequence can permit arbitrary code execution in the broker’s Java virtual machine through bean factory methods such as Runtime.exec().
The vulnerability is classified under CWE-94, improper control of code generation, also known as code injection. The advisory identifies the affected range as SOI 2.0.0 through 2.2.0 and lists the product as known affected. Hitachi Energy’s internal team reported the vulnerability to CISA.
Hitachi Energy’s specified fix is the cumulative SOI EP2 patch. The update raises the ActiveMQ version used by the SOI Core to 5.19.5 and includes the changes from the earlier EP1 patch. EP2 also updates SOI management scripts, installs an upgraded OpenJDK 11 environment for the message broker and updates the ActiveMQ client libraries installed in the WildFly module.
Operators should assess the SOI versions present in their environments and apply SOI EP2 through their normal change-control process. Before deploying the update or other defensive measures, CISA advises organizations to perform an impact analysis and risk assessment.
The advisory also directs operators to follow the product’s deployment guidance and general mitigation practices. CISA recommends minimizing network exposure for control-system devices and ensuring they are not accessible from the internet. Control-system networks and remote devices should be placed behind firewalls and isolated from business networks, with only the minimum necessary ports exposed.
Where remote access is necessary, CISA recommends more secure methods such as virtual private networks, while noting that VPNs and the devices connected to them must be kept updated and protected. Organizations should also use established internal procedures to report suspected malicious activity and follow applicable ICS cybersecurity practices.