Cyber Security· Important

Hitachi Energy SOI Hit by High-Severity ActiveMQ Code Execution Flaw

In short: CISA published an advisory for Hitachi Energy's SOI product, versions 2.0.0 through 2.2.0, affected by CVE-2026-34197, a code-injection vulnerability in the Apache ActiveMQ component with a CVSS score of 8.8. An authenticated attacker can abuse the Jolokia JMX-HTTP bridge exposed by ActiveMQ to trigger remote code execution on the broker's JVM. Hitachi Energy has released the EP2 patch, which upgrades ActiveMQ to version 5.19.5 and updates related OpenJDK and client components.

Source: CISA Advisories6 Oct 2026, 15:00Hitachi Energy Original article ↗

This summary was generated automatically by AI from CISA Advisories's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.

What changed?

1Affected product: Hitachi Energy SOI versions 2.0.0 to 2.2.0
2CVE-2026-34197, CVSS v3.1 score 8.8 (High), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3Vulnerability type: Improper Input Validation / Code Injection (CWE-94) in Apache ActiveMQ's Jolokia JMX-HTTP bridge
4Fix: apply vendor patch SOI EP2, upgrading ActiveMQ to 5.19.5, OpenJDK to version 11, and ActiveMQ client libraries in the WildFly module
5Not reported as actively exploited; requires authenticated access to exploit

Why it matters

This is an industrial control system advisory for an energy-sector product, not directly related to voice AI, but it illustrates how message-broker components like Apache ActiveMQ can be exploited for remote code execution when management interfaces are exposed, a pattern relevant to any infrastructure using message brokers.

What it means for AI agents and contact centers

This specific advisory concerns Hitachi Energy's SOI industrial product and is not relevant unless your infrastructure uses Apache ActiveMQ or similar JMS brokers; if so, check whether Jolokia JMX-HTTP bridges are exposed and restrict access accordingly, and ensure brokers are patched and not internet-facing.

CVE ICS Apache ActiveMQ Energy Sector RCE CVSS 8.8

Sources

CISA AdvisoriesOfficialPrimary source
„Hitachi Energy SOI“
6 Oct 2026, 15:00
Licence: US federal government work (17 U.S.C. §105) · our summary (content changed)
Original article →

Published by source: 6 Oct 2026, 15:00
Found by our system: 6 Oct 2026, 19:35
Summary generated: 6 Oct 2026, 19:37

This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy