Critical Remote Code Execution Vulnerability in Hitachi Energy SOI

Hitachi Energy has issued a security advisory regarding a Remote Code Execution vulnerability in the Apache ActiveMQ component integrated within the SOI product. The vulnerability, identified as CVE-2026-34197, carries a CVSS v3 base score of 8.8 and is classified as HIGH severity.

The flaw resides in the Jolokia JMX-HTTP bridge, which is exposed on the web console at the /api/jolokia/ endpoint. The default Jolokia access policy permits execution operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

According to the advisory, an authenticated attacker can invoke these operations using a crafted discovery URI. This triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context via ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

Impacted versions of Hitachi Energy SOI range from 2.0.0 to 2.2.0. The vulnerability affects the Critical Infrastructure sector, specifically the Energy vertical, with worldwide deployment.

Hitachi Energy has released a cumulative patch, designated SOI EP2, which upgrades the ActiveMQ version for the SOI Core to 5.19.5. This patch also upgrades SOI management scripts, installs an upgraded OpenJDK version 11 to run the ActiveMQ message broker in the newer JRE, and updates the ActiveMQ client libraries installed in the WildFly module. Hitachi Energy's internal team reported the vulnerability to CISA.

Mitigation recommendations include applying the SOI EP2 patch, reviewing product deployment guidelines for securing the product environment, and adhering to general security practices such as network segmentation, firewall configuration, and restricting unauthorized access to process control systems.