IM
IronMonkey Threat Research
‹ Back to ICS Advisories

Hitachi Energy SOI

HIGH
CVSS 8.8
Date 2026-10-06T06:00:00+00:00
Source cisa-csaf
Published by CISA

// Description

Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality, integrity, and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2026-34197 8.8 high
CVE-2026-34197. Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ used in SOI product. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

// Remediations (2)

Mitigation: Follow General Mitigation Factors/Workarounds and refer to the product deployment guidelines for sec
Follow General Mitigation Factors/Workarounds and refer to the product deployment guidelines for securing the product environment.
Patch: Apply the patch SOI EP2, which upgrades the ActiveMQ version (JMS message broker) for the SOI Core t
Apply the patch SOI EP2, which upgrades the ActiveMQ version (JMS message broker) for the SOI Core to version 5.19.5. EP2 is a cumulative patch that covers previous EP1 patch. EP2 also upgrades the SOI management scripts to the latest version and installs an upgraded OpenJDK version 11 to run ActiveMQ MESSAGE BROKER in the newer JRE. It also upgrades the ActiveMQ client libraries installed in the WildFly module.

// References