Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities, discovered by EDF, can end up exploited to potentially cause confidentiality, integrity and availability impact on the product.
Hitachi Energy Asset Suite (formally known as Asset Suite EAM) is a comprehensive enterprise asset management (EAM) software solution built for complex, mission-critical industries like power generation, nuclear facilities, utilities, and transportation.
The following versions of Hitachi Energy Asset Suite suffer from the issue: Asset Suite version up to and including 9.9.0.
In one issue, Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can end up used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is for testing purposes in a non-production environment.
CVE-2026-7395 is the case number for the vulnerability, which has a CVSS V3 base score of 8.1. There is also a V4 base score of 8.5.
Another Vulnerability
Additionally, Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets should perform specific functions within production environment depending on the configuration of the Asset Suite application.
CVE-2026-11796 is the case number for the vulnerability, which has a CVSS V3 base score of 4.3. There is also a V4 base score of 5.1.
The product sees use mainly in the energy sector, and on a global basis.
In terms of mitigations, update or upgrade to Asset Suite 9.9.1 when available.
Users should disable the affected servlet HTTPPublishAdapterTestServlet which is for testing purposes used in non-production environment.
Functionality of the servlets, PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet need to end up evaluated for its utility in the production environment.
For additional information and support, contact your product provider or Hitachi Energy service organization. Click here for contact information.
Security Practices
Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network.
Such practices include process control systems end up physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and remain separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case.
Process control systems should not end up used for Internet surfing, instant messaging, or receiving emails. You should scan portable computers and removable storage media for viruses before they connect to a control system.
Furthermore, users should follow proper password policies and processes.
Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification.