Hitachi Energy SOI

Hitachi Energy has disclosed a critical Remote Code Execution (RCE) vulnerability (CVE-2026-34197) in the Apache ActiveMQ component used in its SOI product versions 2.0.0 through 2.2.0. The vulnerability stems from improper input validation and code injection issues in Apache ActiveMQ's Jolokia JMX-HTTP bridge, which exposes exec operations on ActiveMQ MBeans by default. An authenticated attacker can exploit this by invoking broker operations with a crafted URI that loads a remote Spring XML application context, leading to arbitrary code execution on the broker's JVM. The CVSS v3.1 base score is 8.8 (HIGH), impacting confidentiality, integrity, and availability. The fix involves applying patch SOI EP2, which upgrades ActiveMQ to version 5.19.5 and includes additional component upgrades. This affects critical infrastructure in the energy sector and is deployed worldwide. The vulnerability was reported internally by Hitachi Energy's own team to CISA.