Unauthenticated Servlet Access Vulnerabilities in Hitachi Energy Asset Suite (CVE‑2026‑7395, CVE‑2026‑11796) Threaten Energy Control Systems
What It Is – Hitachi Energy disclosed two critical flaws (CVE‑2026‑7395, CVE‑2026‑11796) in Asset Suite ≤ 9.9.0 that allow unauthenticated users to invoke a testing servlet and upload configuration files. The issue can lead to information disclosure, integrity loss, and potential service disruption.
Exploitability – The vulnerabilities are publicly known, have a CVSS v3 base score of 8.1 (High), and can be exploited without credentials. No public exploit code has been observed, but the attack surface is trivial (HTTP request to the servlet).
Affected Products – Hitachi Energy Asset Suite versions 9.9.0 and earlier (all deployments worldwide, primarily in the energy sector).
Why It Matters for Trust & Control Assurance
- Access Control – Unauthenticated access to a privileged function violates the control objective of enforcing authentication for all critical services. Continuous evidence of proper access enforcement is a core trust signal for auditors.
- Configuration Management – The ability to upload arbitrary configuration files bypasses change‑control processes, undermining the integrity of system baselines.
- Audit Readiness – Demonstrating that the servlet is disabled or patched provides defensible evidence for compliance reviews and reduces the risk of audit findings related to insecure default settings.
Recommended Actions
- Deploy the vendor‑provided patch (upgrade to Asset Suite 9.9.1) as soon as it is available.
- If patching cannot be performed immediately, disable the
HTTPPublishAdapterTestServletper Hitachi’s mitigation guidance. - Verify that authentication is enforced on all public‑facing endpoints via penetration testing or automated scanning.
- Update your asset inventory and configuration‑management records to reflect the remediation status.
- Enable logging of servlet access and monitor for anomalous requests.
Source: CISA Advisory – ICSA‑26‑279‑03