Vulnerability · Published Sep 29, 2026 · Assigned by Hitachi Energy
CVE-2026-7395
High 8.5
In plain English
A high-severity missing authentication in Asset Suite from Hitachi Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.2%top 83.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | Asset Suite | 9.6.0 – through 9.9.0 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N