CISA ADP Vulnrichment

Why this deserves its current priority

CVSS is 8.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Hitachi Energy/Asset Suite (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Hitachi Energy/Asset Suite.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 29, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 29, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 29, 2026

Sources and claim methodology

• Source referencepublisher.hitachienergy.com

Related CVEs

• Marmite through 0.4.2 Unauthenticated API Access via Development ServerAlso CWE-306
• Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for DatabasesSame generic ecosystem
• MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB DeserializationSame generic ecosystem
• Electron: Sandboxed preload code cache can be poisoned by a compromised rendererSame generic ecosystem
• mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packetSame generic ecosystem
• CISA ADP VulnrichmentSame generic ecosystem