> ## Content Index
> Fetch the complete content index at: https://www.stirup.si/llms.txt
> Use this file to discover other available public pages before exploring further.

# Hitachi Energy SOI: Critical RCE Vulnerability in Apache ActiveMQ Component
- URL: https://www.stirup.si/hitachi-energy-soi-critical-rce-vulnerability-in-apache-activemq-compo-3bf96eac/
- Published: 2026-10-12T05:37:55.000Z
- Updated: 2026-10-12T05:37:55.000Z
- Description: A critical remote code execution (RCE) vulnerability has been identified in Hitachi Energy's SOI product versions 2.0.0 to 2.2.0, stemming from an Apache ActiveMQ component. This vulnerability allows authenticated attackers to execute arbitrary code on the broker's JVM, posing significant risks to s
- Author: Satish Das
- Tags: Security, Stirup Research

## Overview of the Vulnerability

A critical remote code execution (RCE) vulnerability has been identified in Hitachi Energy's SOI product versions 2.0.0 to 2.2.0, stemming from an Apache ActiveMQ component. This vulnerability allows authenticated attackers to execute arbitrary code on the broker's JVM, posing significant risks to system integrity and availability. The vulnerability is attributed to improper input validation and code injection in the Apache ActiveMQ Broker, which is used within the SOI product.

## Technical Details and Exploitation Path

The Apache ActiveMQ Classic component in the affected SOI versions exposes the Jolokia JMX-HTTP bridge at `/api/jolokia/` on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans, including `BrokerService.addNetworkConnector(String)` and `BrokerService.addConnector(String)`. An authenticated attacker can exploit this by crafting a discovery URI that triggers the VM transport's `brokerConfig` parameter to load a remote Spring XML application context using `ResourceXmlApplicationContext`. This leads to arbitrary code execution on the broker's JVM through bean factory methods such as `Runtime.exec()`.

## Impact and Risk Assessment

The vulnerability has a CVSS v3.1 score of 8.8, indicating a high severity level. It affects the confidentiality, integrity, and availability of the product. The vulnerability is particularly concerning for critical infrastructure sectors, such as energy, where the deployment of SOI systems is widespread. The potential for unauthorized access and execution of arbitrary code on the broker's JVM could lead to severe operational disruptions, data breaches, or system compromise.

## Remediation and Mitigation

Hitachi Energy recommends applying the patch SOI EP2, which upgrades the ActiveMQ version to 5.19.5 and includes additional security enhancements. This patch also upgrades the SOI management scripts, installs an updated OpenJDK version 11, and updates the ActiveMQ client libraries. In the absence of a patch, organizations should follow general mitigation factors, such as securing the product environment, limiting network exposure, and isolating control systems from external networks.

## Broader Security Considerations

Organizations should implement recommended security practices, including the use of firewalls, secure remote access methods, and strict password policies. It is also crucial to conduct regular impact analysis and risk assessments before deploying any defensive measures. CISA emphasizes the importance of minimizing network exposure for all control system devices and ensuring they are not accessible from the internet.

## Conclusion

The identified vulnerability in Hitachi Energy's SOI product highlights the importance of timely patch management and robust security configurations in industrial control systems. Organizations should prioritize applying the recommended patch and implementing additional security measures to mitigate the risk of exploitation. Continued vigilance and adherence to cybersecurity best practices are essential to protect critical infrastructure from potential threats.

**Source:** [CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-04?ref=stirup.si). Analysis based on publicly available information; no hands-on testing is claimed.