Hitachi Energy Asset Suite

Hitachi Energy Asset Suite versions 9.9.0 and prior are affected by two unauthenticated servlet access vulnerabilities. CVE-2026-7395 allows unauthenticated access to HTTPPublishAdapterTestServlet, enabling configuration file uploads leading to information disclosure and integrity compromise (CVSS 3.1: 8.1 HIGH). CVE-2026-11796 allows unauthenticated access to PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet, potentially causing denial-of-service conditions (CVSS 3.1: 4.3 MEDIUM). Both vulnerabilities are classified under CWE-306 Missing Authentication for Critical Function. The affected product is deployed worldwide in the Energy critical infrastructure sector. Remediation involves upgrading to Asset Suite 9.9.1 when available, and immediate mitigation includes disabling the affected servlets. EDF reported these vulnerabilities to CISA.